https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:49:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326522 EUVD-2026-326522 https://cve.radiocsirt.org/vuln/euvd-2026-326522 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46618 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command(...) after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. /bin/sh -c &#39;...&#39;) and execute arbitrary code in the builder pod context. This issue has been patched in version 1.23.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command(...) after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. /bin/sh -c &#39;...&#39;) and execute arbitrary code in the builder pod context. This issue has been patched in version 1.23.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46618 https://cve.radiocsirt.org/vuln/ghsa-7pjr-qpvh-m339 <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>Before the round-1 security sweep, `pkg/builder/builder.go` passed `Environment.spec.builder.command` directly into `exec.Command(...)` after a `strings.Fields` split, with no validation of the executable path or its arguments. A user who could create or update `Environment` CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. `/bin/sh -c &#39;...&#39;`) and execute arbitrary code in the builder pod context.</p> <p>### Affected component</p> <p>- `pkg/builder/builder.go:254` — call site (`exec.Command(buildCmd, buildArgs...)`). - `pkg/builder/builder.go:106` — input source: `buildCmd, buildArgs = strings.Fields(req.BuildCommand)[0], strings.Fields(req.BuildCommand)[1:]`.</p> <p>### Impact</p> <p>A subject with `create` / `update` privilege on `Environment` objects could:</p> <p>1. Cause the builder pod for any package using that environment to execute arbitrary code. 2. Read whatever files the builder pod has access to inside its `/packages` shared volume (deployment archive payloads for that package). 3. Write arbitrary content into the `/packages` shared volume, which the fetcher subsequently uploads as the package deployment archive.</p> <p>The builder pod runs in the user&#39;s namespace with the `fission-builder` SA (not the more-privileged executor SA), so the impact is bounded to that namespace&#39;s package contents and the builder pod&#39;s own filesystem. `PR:H` reflects that creating / modifying `Environment` CRDs is typically r…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>Before the round-1 security sweep, `pkg/builder/builder.go` passed `Environment.spec.builder.command` directly into `exec.Command(...)` after a `strings.Fields` split, with no validation of the executable path or its arguments. A user who could create or update `Environment` CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. `/bin/sh -c &#39;...&#39;`) and execute arbitrary code in the builder pod context.</p> <p>### Affected component</p> <p>- `pkg/builder/builder.go:254` — call site (`exec.Command(buildCmd, buildArgs...)`). - `pkg/builder/builder.go:106` — input source: `buildCmd, buildArgs = strings.Fields(req.BuildCommand)[0], strings.Fields(req.BuildCommand)[1:]`.</p> <p>### Impact</p> <p>A subject with `create` / `update` privilege on `Environment` objects could:</p> <p>1. Cause the builder pod for any package using that environment to execute arbitrary code. 2. Read whatever files the builder pod has access to inside its `/packages` shared volume (deployment archive payloads for that package). 3. Write arbitrary content into the `/packages` shared volume, which the fetcher subsequently uploads as the package deployment archive.</p> <p>The builder pod runs in the user&#39;s namespace with the `fission-builder` SA (not the more-privileged executor SA), so the impact is bounded to that namespace&#39;s package contents and the builder pod&#39;s own filesystem. `PR:H` reflects that creating / modifying `Environment` CRDs is typically r…</p> https://cve.radiocsirt.org/vuln/ghsa-7pjr-qpvh-m339