CVE-2026-33310
- Source
- https://cve.org/CVERecord?id=CVE-2026-33310
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33310.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-33310
- Aliases
- Downstream
- Related
- Published
- 2026-03-24T13:17:38.572Z
- Modified
- 2026-07-15T01:48:59.511592970Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Intake has a Command Injection via shell() Expansion in Parameter Defaults
- Details
-
Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.
- Database specific
{ "cwe_ids": [ "CWE-78", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33310.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/intake/intake
Affected ranges
- Type
- GIT
- Repo
- https://github.com/intake/intake
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:intake:intake:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "2.0.9" } ] }
Affected versions
0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.7.0
2.*
2.0.0
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8