CVEvulnerability

CVE-2026-63046

8.8 HIGH Published 2026-08-21 Modified 2026-10-16 Official page ↗
Status
Analyzed
Published
2026-08-21
Last modified
2026-10-16
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-88

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it. [1]  https://github.com/apache/inlong/pull/12151 . [2]  https://github.com/apache/inlong/pull/12155 .

Affected configurations

• apache inlong (>= 2.0.0 < 2.4.0)

Related

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References