Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M
CVE-2026-33310Intake has a Command Injection via shell() Expansion in Parameter Defaults
High 8.8
In plain English
A high-severity OS command injection in intake from intake. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | intake | no fix listed | GHSA-37g4-qqqv-7m99 |
| PyPI | intake | 2.0.9 | PYSEC-2026-2185 |
Affected products (as reported)
Weakness: CWE-78, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H