CVE-2026-33310 - Vulnerability Analysis

Overview

Intake < 2.0.9 contains a command injection caused by automatic expansion of shell() syntax in parameter default values during catalog parsing, letting attackers execute arbitrary commands by loading malicious catalog YAML, exploit requires loading malicious catalog.

Severity & Score

Impact

Attackers can execute arbitrary commands on the host system by loading a malicious catalog, potentially leading to full system compromise.

Mitigation

Update to version 2.0.9 or later.

References

• https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b
• https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner