VulnerabilityAnalyzed

CVE-2026-33310

If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed.

HIGH 8.8EPSS 0.43%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.43% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-78, CWE-94
Affected: intake/intake
Source: security-advisories@github.com

References

https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1bPatch
https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.