https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:59:47.205702+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326522 EUVD-2026-326522 2026-10-06T22:59:47.251160+00:00 EUVD-2026-326522 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46618 fkie_cve-2026-46618 2026-10-06T22:59:47.251202+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command(...) after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. /bin/sh -c '...') and execute arbitrary code in the builder pod context. This issue has been patched in version 1.23.0.

 https://cve.radiocsirt.org/vuln/ghsa-7pjr-qpvh-m339 GHSA-7pjr-qpvh-m339 — Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to i… 2026-10-06T22:59:47.251290+00:00

Affected: Go: github.com/fission/fission

### Summary

Before the round-1 security sweep, `pkg/builder/builder.go` passed `Environment.spec.builder.command` directly into `exec.Command(...)` after a `strings.Fields` split, with no validation of the executable path or its arguments. A user who could create or update `Environment` CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. `/bin/sh -c '...'`) and execute arbitrary code in the builder pod context.

### Affected component

- `pkg/builder/builder.go:254` — call site (`exec.Command(buildCmd, buildArgs...)`). - `pkg/builder/builder.go:106` — input source: `buildCmd, buildArgs = strings.Fields(req.BuildCommand)[0], strings.Fields(req.BuildCommand)[1:]`.

### Impact

A subject with `create` / `update` privilege on `Environment` objects could:

1. Cause the builder pod for any package using that environment to execute arbitrary code. 2. Read whatever files the builder pod has access to inside its `/packages` shared volume (deployment archive payloads for that package). 3. Write arbitrary content into the `/packages` shared volume, which the fetcher subsequently uploads as the package deployment archive.

The builder pod runs in the user's namespace with the `fission-builder` SA (not the more-privileged executor SA), so the impact is bounded to that namespace's package contents and the builder pod's own filesystem. `PR:H` reflects that creating / modifying `Environment` CRDs is typically r…