EUVD-2026-275059

fkie_cve-2026-29042

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

GHSA-95fj-3w7g-4r27 — Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Affected: Go: github.com/nuclio/nuclio

## Summary

This vulnerability exists in Nuclio's Shell Runtime component, allowing attackers with function invocation permissions to inject malicious commands via HTTP request headers, execute arbitrary code with root privileges in function containers, steal ServiceAccount Tokens with cluster-admin level permissions, and ultimately achieve complete control over the entire Kubernetes cluster. Recommended CWE classification: CWE-78 (OS Command Injection).

Nuclio Shell Runtime processes the `X-Nuclio-Arguments` HTTP header without validation or escaping, directly concatenating user input into shell commands executed via `sh -c`. This allows arbitrary command injection, enabling attackers to read sensitive files (including ServiceAccount tokens) and access the Kubernetes API with cluster-level privileges.

## Details

### Vulnerability Description

The Nuclio Shell Runtime component contains a critical command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the `X-Nuclio-Arguments` header and directly incorporates its value into shell commands without any validation or sanitization.

### Root Cause Analysis

**Vulnerable Code Location 1:** `pkg/processor/runtime/shell/runtime.go:289-297`

```go func (s *shell) getCommandArguments(event nuclio.Event) []string { arguments := event.GetHeaderString(headers.Arguments)

if arguments == "" { arguments = s.configuration.Arguments }

ret…

Most recent entries from all

EUVD-2026-275059

fkie_cve-2026-29042

GHSA-95fj-3w7g-4r27 — Nuclio Shell Runtime Command Injection Leading to Privilege Escalation