EUVD-2026-29510
GHSA-q43r-5xx6-v6jq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS file operation utilities. The vulnerability arises from the unsafe construction and execution of shell commands via os.system() without proper input sanitization or escaping. User-controlled input (such as file paths) is directly interpolated into shell command strings using f-strings within the _copy() function. An attacker can inject arbitrary OS commands by supplying a specially crafted path parameter through the Hydra configuration framework. This leads to remote code execution with the privileges of the user running the TinyZero training process.
AnalysisAI
Remote code execution in TinyZero's HDFS utilities allows unauthenticated attackers to execute arbitrary OS commands via crafted file paths passed through the Hydra configuration framework. The vulnerability stems from unsanitized user input directly interpolated into os.system() shell commands within the _copy() function, affecting all deployments through commit 6652a63c57fa. No active exploitation confirmed at time of analysis, but EPSS score of 0.14% (33rd percentile) suggests below-average likelihood despite CVSS:9.8 critical rating. The attack requires network access to the TinyZero training process and ability to control path parameters via configuration.
Technical ContextAI
TinyZero is a machine learning project utilizing HDFS (Hadoop Distributed File System) operations for distributed storage. The vulnerability manifests in Python code where the _copy() function constructs shell commands using f-string interpolation before passing them to os.system() - a dangerous pattern that bypasses Python's built-in parameter escaping. The root cause is CWE-78 (OS Command Injection), occurring when external input flows into shell execution contexts without sanitization. The Hydra configuration framework, typically used for managing ML experiment hyperparameters, becomes an attack vector by allowing adversaries to inject path parameters containing shell metacharacters (semicolons, pipes, backticks, etc.). This represents a classic injection vulnerability where the application fails to distinguish between data and executable commands in a shell context.
RemediationAI
Immediate remediation requires replacing os.system() calls with subprocess.run() using list-based argument passing to prevent shell interpretation of metacharacters, specifically: subprocess.run(['hdfs', 'dfs', '-cp', source_path, dest_path], check=True). No vendor-released patch or fixed version number has been identified at time of analysis - the vulnerability affects the latest available commit. Organizations should implement input validation using allowlists for permitted path characters (alphanumeric, forward slash, hyphen, underscore only) and reject any input containing shell metacharacters (; | & $ ` \ < > ). As a temporary mitigation, restrict network access to the TinyZero training service endpoint to trusted internal networks only, and enforce that all Hydra configuration parameters originate from administrator-controlled sources rather than user input. Deploy the training process under a low-privilege service account with minimal filesystem permissions to limit impact scope. Note that input validation as the sole control carries risk of bypass - the architectural fix of eliminating shell invocation is strongly preferred.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today