Nuclio up to 1.15.19 special elements into a different plane (special element injection)

Summaryinfo

A vulnerability categorized as critical has been discovered in Nuclio up to 1.15.19. Impacted is an unknown function. Executing a manipulation can lead to failure to sanitize special elements into a different plane (special element injection). This vulnerability is registered as CVE-2026-29042. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Nuclio up to 1.15.19 and classified as critical. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a failure to sanitize special elements into a different plane (special element injection) vulnerability. The CWE definition for the vulnerability is CWE-75. The product does not adequately filter user-controlled input for special elements with control implications. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-29042 since 03/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.15.20 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5352d7e16cf92f4350a2f8d806c4b80b626b5c5a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Nuclio

Version

• 1.15.0
• 1.15.1
• 1.15.2
• 1.15.3
• 1.15.4
• 1.15.5
• 1.15.6
• 1.15.7
• 1.15.8
• 1.15.9
• 1.15.10
• 1.15.11
• 1.15.12
• 1.15.13
• 1.15.14
• 1.15.15
• 1.15.16
• 1.15.17
• 1.15.18
• 1.15.19

License

• open-source

Website

• Product: https://github.com/nuclio/nuclio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion