Command Injection Vulnerability in Apache InLong's Agent Installer
CVE-2026-63046

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Inlong
Vendor
CVE Published:
21 August 2026

What is CVE-2026-63046?

A vulnerability in Apache InLong's Agent Installer allows for arbitrary shell command execution through improper handling of argument delimiters. The issue arises from the ExecuteLinux.exeCmd() function, which fails to validate input properly, creating a pathway for attackers to inject malicious commands. Users of Apache InLong versions prior to 2.4.0 are strongly encouraged to upgrade to version 2.4.0 or apply the relevant patches from the repository to mitigate this security risk. For more information, refer to the official Apache advisory.

Affected Version(s)

Apache InLong 2.0.0 < 2.4.0

References

https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yy...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

IcySun
.