Code Injection Vulnerability in Nuclio's Java Runtime for Data Processing

CVE-2026-52833

What is CVE-2026-52833?

The Nuclio serverless framework's Java runtime had a critical flaw that allowed for code injection during function builds. This vulnerability was due to the improper handling of the build.gradle file generated by the framework, specifically through the use of Go's text/template package, which did not correctly escape template actions. Attackers could potentially exploit this flaw by including a closing brace in runtimeAttributes.repositories[], which would break out of the intended block and execute arbitrary Groovy statements unconditionally during the Gradle configuration phase. This issue has been rectified in version 1.16.5.

References