Code injection in Nuclio Java runtime build pipeline (CVE-2026-52833)

CVE-2026-52833 is a code injection vulnerability (CWE-94) in Nuclio's Java runtime build pipeline, where unsanitized values from the `runtimeAttributes.repositories` field are rendered verbatim into a Groovy `build.gradle` file via Go's `text/template` package, allowing an attacker to inject arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. Because the Dashboard API uses NOP authentication by default and the build container runs as root, an unauthenticated remote attacker can achieve OS command execution as root inside the function builder container with a single HTTP POST request. This is rated CVSS 3.1 10.0 (Critical): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Affected versions: - <= 1.15.27 We recommend updating to: 1.16.5. CVSS 8.0 · our assessment: this_week Vendor advisory: https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww Details: https://vuln.today/cve/CVE-2026-52833