Checkov by Prisma Cloud EUVD-2026-75270

Exploitation requires the attacker to have local file-system write access to a directory that Checkov scans, and a user or automated process must subsequently run Checkov against that location (UI:P - passive interaction). The attack vector is strictly local (AV:L), ruling out remote unauthenticated exploitation. The attacker cannot trigger the injection remotely; they must first have the ability to place or modify files in a scanned path. The elevated subsequent-system impact (SC:H/SI:H/SA:H) only materialises when the Checkov process holds meaningful access to external systems such as cloud provider credentials or production infrastructure - common in CI/CD pipelines but absent in isolated local development use. Read-only access to a scanned repository is not sufficient to exploit this issue.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) confines exploitation to local access with passive user interaction - someone must run Checkov against attacker-controlled IaC content. The raw vulnerable-system impact is low (VC:N/VI:L/VA:N), but the subsequent-system metrics (SC:H/SI:H/SA:H) capture the real-world concern: Checkov processes executing inside CI/CD pipelines routinely hold access to cloud provider credentials, deployment keys, and production infrastructure, meaning a successful injection can pivot to cloud account compromise. Even a mid-sized municipal IT team in bytom running Checkov as their IaC security gate should treat this as a meaningful risk if externally-contributed code enters their scan pipeline without prior review gates. The reported score of 1.1 is heavily discounted by E:U and the supplemental remediation and value metrics; it understates raw base-level scope-change impact. No EPSS data was included in the provided intelligence, and the vulnerability is neither in CISA KEV nor associated with a known public PoC, which supports the low urgency signal for most environments. Priority rises significantly for any pipeline that grants Checkov broad cloud credentials or runs it against untrusted third-party IaC repositories.

A user with local file-system write access places a crafted IaC template - such as a Terraform configuration with a specially constructed resource value containing shell metacharacters - into a path monitored by Checkov. When a developer or CI/CD automation job runs Checkov against that path, the injected command executes under the Checkov process context, which in typical pipeline deployments holds cloud API keys or deployment credentials, enabling lateral movement to cloud infrastructure.