What is the CVSS score of CVE-2026-29042?

CVE-2026-29042 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of AI / ML are affected by CVE-2026-29042?

Nuclio Shell Runtime versions prior to 1.15.20 contain a critical command injection vulnerability (CVSS 9.8) that allows attackers to execute arbitrary code on affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-29042?

Yes, a public proof-of-concept exploit is available for CVE-2026-29042. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-29042?

Within 24 hours: Identify all systems running Nuclio versions prior to 1.15.20 and isolate them from production networks if patching cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade all affected Nuclio instances to version 1.15.20 or later, with testing in non-production environments first. Within 30 days: Conduct forensic analysis of patched systems for signs of compromise, review access logs for suspicious activity, and implement monitoring for command injection attack patterns.

AI / ML CVE-2026-29042

CRITICAL

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)

2026-03-06 security-advisories@github.com

GHSA-95fj-3w7g-4r27

Command Injection AI / ML Nuclio Suse

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 19:32 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 19:32 nvd

Patch available

CVE Published

Mar 06, 2026 - 07:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

AnalysisAI

Shell command injection in Nuclio serverless framework before 1.15.20. PoC and patch available.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send HTTP request with malicious X-Nuclio-Arguments header

Exploit

Runtime incorporates header value into shell command

Execution

Execute arbitrary shell commands

Impact

Achieve remote code execution

Access

Send HTTP request with malicious X-Nuclio-Arguments header

Exploit

Runtime incorporates header value into shell command

Execution

Execute arbitrary shell commands

Impact

Achieve remote code execution

Vulnerability AssessmentAI

Exploitation	Nuclio Shell Runtime versions prior to 1.15.20 with HTTP function invocation enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8, EPSS 0.69%. Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Inject commands through serverless function deployment.
Remediation	Update. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running Nuclio versions prior to 1.15.20 and isolate them from production networks if patching cannot be completed immediately. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: Critical

CVE-2026-29042 vulnerability details – vuln.today

Back

AI / ML CVE-2026-29042

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code