CVE-2026-33310 - Vulnerability Analysis

Overview

Intake < 2.0.9 contains a command injection caused by automatic expansion of shell() syntax in parameter default values during catalog parsing, letting attackers execute arbitrary commands by loading malicious catalog YAML, exploit requires loading malicious catalog.

Severity & Score

Impact

Attackers can execute arbitrary commands on the host system by loading a malicious catalog, potentially leading to full system compromise.

Mitigation

Update to version 2.0.9 or later.

References

• https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b
• https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🟠 CVE-2026-33310 - High (8.8) Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contai... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33310/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner