https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 01:44:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268268 EUVD-2026-268268 https://cve.radiocsirt.org/vuln/euvd-2026-268268 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26056 <p>Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the overrides.yoke.cd/flight annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.</p> <p>Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the overrides.yoke.cd/flight annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26056 https://cve.radiocsirt.org/vuln/ghsa-wj8p-jj64-h7ff <p><strong>Affected:</strong> Go: github.com/yokecd/yoke</p> <p># Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC</p> <p>This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.</p> <p>**Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection)</p> <p>## Summary</p> <p>Yoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code.</p> <p>## Details</p> <p>The vulnerability exists in two code paths:</p> <p>**Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`): ```go const ( AnnotationOverrideFlight = &#34;overrides.yoke.cd/flight&#34; AnnotationOverrideMode = &#34;overrides.yoke.cd/mode&#34; ) ```</p> <p>**Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`): ```go if overrideURL, _, _ := unstructured.NestedString(cr.Object,…</p> <p><strong>Affected:</strong> Go: github.com/yokecd/yoke</p> <p># Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC</p> <p>This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.</p> <p>**Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection)</p> <p>## Summary</p> <p>Yoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code.</p> <p>## Details</p> <p>The vulnerability exists in two code paths:</p> <p>**Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`): ```go const ( AnnotationOverrideFlight = &#34;overrides.yoke.cd/flight&#34; AnnotationOverrideMode = &#34;overrides.yoke.cd/mode&#34; ) ```</p> <p>**Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`): ```go if overrideURL, _, _ := unstructured.NestedString(cr.Object,…</p> https://cve.radiocsirt.org/vuln/ghsa-wj8p-jj64-h7ff