Which versions of Google Turbinia are affected by EUVD-2026-56241?

Google Turbinia's forensic worker fleet contains an OS command injection vulnerability (CVSS 7.5) allowing attackers with processing request capability to execute arbitrary commands on forensic…. A patch is available.

How to fix or mitigate EUVD-2026-56241?

Within 24 hours, identify and inventory all systems running Google Turbinia, documenting current versions and worker node configurations. Within 7 days, deploy the vendor patch released July 10, 2026 to all Turbinia worker nodes; this update modifies the grep, photorec, and strings workers to use list-based subprocess invocation instead of shell command interpolation, eliminating the command injection vector. Within 30 days, verify patch deployment across all worker infrastructure, execute test forensic workflows to confirm operational integrity, audit access controls for Turbinia processing request submission, and update security baselines accordingly.

Google Turbinia EUVD-2026-56241

Q: What is the CVSS score of EUVD-2026-56241?

EUVD-2026-56241 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-67180 HIGH

OS Command Injection (CWE-78)

2026-08-11 cisa-cg

GHSA-7wxw-jhvr-m58h

RCE Google Command Injection Turbinia

7.5

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

7.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable API as vector; PR:L because description requires privileges to submit requests, not unauthenticated access; full CIA impact on the worker node.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 16:36 vuln.today

Analysis Generated

Aug 11, 2026 - 16:36 vuln.today

CVSS changed

Aug 11, 2026 - 16:22 NVD

8.4 (HIGH) 7.5 (HIGH)

CVE Published

Aug 11, 2026 - 15:56 cve.org

HIGH 7.5

DescriptionCVE.org

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

AnalysisAI

OS command injection in Google Turbinia's forensic worker fleet allows an attacker who can submit processing requests or control evidence path/name values to execute arbitrary commands on the worker nodes. The root cause, confirmed by PR #1631, is multiple workers (grep, photorec, strings) constructing shell command strings via Python format interpolation and invoking them with shell=True, allowing shell metacharacters in evidence paths to break out of the intended command. The fix, released 2026-07-10, replaces all affected workers with list-based subprocess invocation, eliminating shell interpretation.

Technical ContextAI

Turbinia is an open-source Google framework for distributed forensic artifact processing, deployed as a fleet of worker nodes that execute forensic tools (grep, photorec, strings, etc.) against disk images and other evidence. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause: multiple workers constructed shell command strings by directly interpolating attacker-influenced values (evidence.local_path, evidence.device_path, patterns_file_path) into format strings, then passed those strings to subprocess execution with shell=True. For example, grep.py used 'grep -E -b -n -f {0} {1} > {2}'.format(..., evidence.local_path, ...) with shell=True, meaning a path containing semicolons, backticks, or pipe characters would be interpreted by /bin/sh. The same pattern existed in photorec.py and strings.py. The fix (PR #1631) converts all three workers to list-based command arrays passed without shell=True, so special characters are passed as literal arguments to execvp rather than interpreted by the shell. Affected CPE: cpe:2.3:a:google:turbinia:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is to update Google Turbinia to a version incorporating PR #1631 (merged 2026-07-10), which replaces shell=True string-interpolated commands in grep.py, photorec.py, and strings.py with list-based subprocess invocation. The exact release tag incorporating this fix is not independently confirmed from available data - operators should verify against the commit history at https://github.com/google/turbinia/pull/1631 and check that the installed version post-dates 2026-07-10. If immediate patching is not possible, a compensating control is to restrict who can submit Turbinia processing requests to a tightly controlled, audited set of principals and to sanitize or reject evidence path/name values containing shell metacharacters (semicolons, backticks, pipes, dollar signs) at the API ingestion layer; this reduces the attack surface but does not eliminate the underlying flaw. Additionally, running Turbinia workers in a sandboxed container environment with minimal filesystem and network privileges will limit the blast radius of any successful exploitation. Consult the GitHub issue at https://github.com/google/turbinia/issues/1629 for further context.