p PatchFirst

CVE-2026-33310

CVE-2026-33310 · Intake has a Command Injection via shell() Expansion in Parameter Defaults

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.

CVSS 8.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • intake

    Versions
    • < 2.0.9: Affected

    No fix published

  • intake PyPI

    Versions
    • 0.1.2
    • 0.1.3
    • 0.2.3
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.5.5
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    • 0.6.7
    • 0.6.8
    • 0.7.0
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.1
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    Affected ranges
    • ECOSYSTEM: ≤ 2.0.9

    No fix published

  • intake PyPI

    Versions
    • 0.1.2
    • 0.1.3
    • 0.2.3
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.5.5
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    • 0.6.7
    • 0.6.8
    • 0.7.0
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.1
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    Affected ranges
    • ECOSYSTEM: < 2.0.9

    Update to 2.0.9

Original sources

Check your server →