Command Injection Vulnerability in Nuclio Shell Runtime Affects Serverless Framework
CVE-2026-29042

8.9HIGH

Key Information:

Vendor

Nuclio

Status
Nuclio
Vendor
CVE Published:
6 March 2026

What is CVE-2026-29042?

The Nuclio Shell Runtime, part of the Nuclio serverless framework, contains a command injection vulnerability prior to version 1.15.20. This vulnerability allows an attacker to exploit the system by sending crafted HTTP requests that manipulate the X-Nuclio-Arguments header. The runtime processes these user inputs insecurely, directly embedding them into shell commands without adequate validation or sanitization, potentially enabling unauthorized command execution. Version 1.15.20 includes a patch that resolves this issue.

Affected Version(s)

nuclio < 1.15.20

References

https://github.com/nuclio/nuclio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4030
x_refsource_MISC
https://github.com/nuclio/nuclio/commit/5352d7e16cf92f435...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.