EUVD-2026-29510
GHSA-q43r-5xx6-v6jq
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS file operation utilities. The vulnerability arises from the unsafe construction and execution of shell commands via os.system() without proper input sanitization or escaping. User-controlled input (such as file paths) is directly interpolated into shell command strings using f-strings within the _copy() function. An attacker can inject arbitrary OS commands by supplying a specially crafted path parameter through the Hydra configuration framework. This leads to remote code execution with the privileges of the user running the TinyZero training process.
AnalysisAI
Remote code execution in TinyZero's HDFS utilities allows unauthenticated attackers to execute arbitrary OS commands via crafted file paths passed through the Hydra configuration framework. The vulnerability stems from unsanitized user input directly interpolated into os.system() shell commands within the _copy() function, affecting all deployments through commit 6652a63c57fa. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all TinyZero deployments in production and development environments; verify presence of vulnerable commit 6652a63c57fa; isolate affected systems from untrusted networks and restrict configuration parameter sources to trusted administrators only. Within 7 days: Implement network segmentation to limit TinyZero process access; enable comprehensive logging of configuration changes and file operations; conduct forensic review of HDFS access logs and system command execution history for indicators of exploitation. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today