Approved changes feed: RSS · Atom
cpe:2.3:a:intake:intake:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Intake (2f19e2d7-0982-534e-aa06-3c8089529a93) |
|---|---|
| Product | Intake (0eda81b8-93d7-58a2-823e-8e26435e804b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/intake/intake |
purl2cpe | 2026-06-01 10:12:48.656252 |
pkg:pypi/intake |
purl2cpe | 2026-06-01 10:12:48.656254 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33310 |
vulnerable | 2026-06-08 07:59:09.656144 |
Intake has a Command Injection via shell() Expansion in Parameter Defaults
HIGH (8.8)
Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.
Published: 2026-03-24T13:17:38.572Z
Updated: 2026-03-24T15:36:17.300Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.