8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29042

CVE-2026-29042: Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29042

CVE-2026-29042:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/nuclio/nuclio	go	<= 1.15.9	1.15.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection flaw within the Nuclio Shell Runtime, identified as CVE-2026-29042. The root cause is the improper handling of user-supplied arguments passed through the X-Nuclio-Arguments HTTP header. The analysis of the patch commit 5352d7e16cf92f4350a2f8d806c4b80b626b5c5a confirms the vulnerability and its fix.

The vulnerability unfolds in two stages:

Input Injection: The shell.getCommandArguments function in pkg/processor/runtime/shell/runtime.go reads the X-Nuclio-Arguments header value without any sanitization or validation. This allows an attacker to include shell metacharacters (e.g., ;, |, $()) in the header.
Command Execution: The shell.processEvent function receives these arguments. When the configured handler is a command found in the system's PATH, it constructs a command string by joining the command and the user-supplied arguments. This string is then executed using sh -c, which interprets the injected shell metacharacters, allowing the attacker to execute arbitrary commands.

The patch addresses the vulnerability by modifying shell.processEvent to no longer use sh -c. Instead, it executes the command directly and passes the arguments as a separate slice (exec.CommandContext(context, command[0], command[1:]...)). This ensures that the arguments are treated as literal strings by the operating system and not interpreted by a shell, thus preventing command injection. Both getCommandArguments and processEvent are critical functions that would appear in a runtime profile during exploitation.

Vulnerable functions

shell.getCommandArguments

pkg/processor/runtime/shell/runtime.go

This function retrieves the value from the 'X-Nuclio-Arguments' HTTP header, which serves as the entry point for the malicious payload. It splits the string by spaces but performs no validation or sanitization, allowing shell metacharacters to be passed to the command execution logic.

shell.processEvent

pkg/processor/runtime/shell/runtime.go

This function is the sink for the vulnerability. It takes the command and arguments (which include the unsanitized input from `getCommandArguments`) and, in the vulnerable version, joins them into a single string to be executed by `sh -c`. This method of execution allows the shell to interpret metacharacters in the user-provided arguments, leading to command injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.