{"id":3287,"date":"2026-09-04T04:59:35","date_gmt":"2026-09-03T20:59:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?p=3287"},"modified":"2026-09-04T04:59:35","modified_gmt":"2026-09-03T20:59:35","slug":"cve-2026-79756","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-79756","title":{"rendered":"CVE-2026-79756 &#8211; Nuclio is a &#8220;Serverless&#8221; framework for Real-Time Events and Data Processing. Prior to vers"},"content":{"rendered":"<p>Nuclio is a &#8220;Serverless&#8221; framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local\/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a \/bin\/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Nuclio is a &#8220;Serverless&#8221; framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local\/Docker platf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-3287","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/3287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}