Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M
CVE-2026-46618Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
Medium 6.9
In plain English
A medium-severity OS command injection in fission from fission. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command(...) after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. /bin/sh -c '...') and execute arbitrary code in the builder pod context. This issue has been patched in version 1.23.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fission/fission | 1.23.0 | GHSA-7pjr-qpvh-m339 |
| Go | github.com/fission/fission | 1.23.0 | GO-2026-5230 |
Affected products (as reported)
Weakness: CWE-78, CWE-250, CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/fission/fission/security/advisories/GHSA-7pjr-qpvh-m339 x_refsource_CONFIRM
- https://github.com/fission/fission/pull/3364 x_refsource_MISC
- https://github.com/fission/fission/releases/tag/v1.23.0 x_refsource_MISC