CVE-2026-52833
Received Received - Intake

Code Injection in Nuclio Serverless Framework

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-52833
EUVD
EUVD-2026-70216

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nuclio nuclio to 1.16.5 (exc)
nuclio nuclio 1.16.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52833 is a critical remote code execution (RCE) vulnerability in Nuclio affecting versions 1.15.27 and earlier. It occurs when unsanitized user input in the runtimeAttributes.repositories field is injected into a Groovy build.gradle file during Java function builds. The Go text/template package used for rendering does not escape special characters, allowing attackers to inject malicious Groovy code by embedding a closing brace to break out of the repositories block. This executes arbitrary commands as root in the build container during Gradle's configuration phase.

Detection Guidance

Detecting this vulnerability requires checking Nuclio versions and analyzing build configurations. First, verify if your Nuclio version is below 1.16.5 using: nuclio version. If using Java runtime, inspect build.gradle files for unsanitized repository values. Check logs for unexpected Groovy code execution during builds. Monitor for unauthorized root access in build containers.

Impact Analysis

An attacker can exploit this vulnerability to execute arbitrary commands as root within the build container without authentication. This could lead to complete compromise of the build environment, data theft, or further lateral movement within the system. The vulnerability is exploitable remotely if the Nuclio Dashboard API is exposed.

Compliance Impact

This vulnerability could lead to unauthorized code execution, data breaches, or loss of sensitive data, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations. Organizations using affected Nuclio versions may face legal penalties, reputational damage, and increased scrutiny for failing to implement proper input validation and security controls.

Mitigation Strategies
  • Upgrade Nuclio to version 1.16.5 or later to apply the patch that fixes the vulnerability.
  • Review and validate all Java runtimeAttributes.repositories values in your Nuclio functions to ensure they follow the allowed pattern and do not contain malicious code.
  • Implement strict input validation for any user-supplied values in Nuclio configurations to prevent code injection attempts.
  • Monitor Nuclio logs for unusual build activities or unauthorized command executions during the build process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart