Command Injection Vulnerability in Apache InLong's Agent Installer

CVE-2026-63046

What is CVE-2026-63046?

A vulnerability in Apache InLong's Agent Installer allows for arbitrary shell command execution through improper handling of argument delimiters. The issue arises from the ExecuteLinux.exeCmd() function, which fails to validate input properly, creating a pathway for attackers to inject malicious commands. Users of Apache InLong versions prior to 2.4.0 are strongly encouraged to upgrade to version 2.4.0 or apply the relevant patches from the repository to mitigate this security risk. For more information, refer to the official Apache advisory.

References