CVE-2026-29042
CRITICAL
GHSA-95fj-3w7g-4r27
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.
Analysis
Shell command injection in Nuclio serverless framework before 1.15.20. PoC and patch available.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems running Nuclio versions prior to 1.15.20 and isolate them from production networks if patching cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade all affected Nuclio instances to version 1.15.20 or later, with testing in non-production environments first. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today