CVE-2026-52833
Summary
Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase.
The Dashboard API runs with NOP authentication by default, so no credentials are required. The build container runs as root. The injected command output confirmed by dynamic testing:
[RCE-PROOF] uid=0(root) gid=0(root) groups=0(root)
nuclio-kanikojob.nuclioprocessorvul006rcev3latest.tkxsslz06ppcr
root
BUILD SUCCESSFUL in 512ms
- CWE: CWE-94 (Improper Control of Generation of Code / Code Injection)
- Affected versions: Nuclio <= 1.15.27 (latest as of 2026-05-17, dynamically verified)
Details
Root Cause
pkg/processor/build/runtime/java/runtime.go — function createGradleBuildScript()
Step 1. User input flows from the API into the template data map without validation
types.go:50-64 — newBuildAttributes() decodes runtimeAttributes with no content inspection. Any string is accepted for each element of Repositories:
// pkg/processor/build/runtime/java/types.go:50-64
func newBuildAttributes(encodedBuildAttributes map[string]interface{}) (*buildAttributes, error) {
newBuildAttributes := buildAttributes{}
if err := mapstructure.Decode(encodedBuildAttributes, &newBuildAttributes); err != nil {
return nil, errors.Wrap(err, "Failed to decode build attributes")
}
if len(newBuildAttributes.Repositories) == 0 {
newBuildAttributes.Repositories = []string{"mavenCentral()"}
}
return &newBuildAttributes, nil // no validation of repository string contents
}
Step 2. text/template renders repositories verbatim into Groovy DSL
runtime.go:111,139 — the template is parsed with text/template, which does not HTML-encode or escape special characters. {{ . }} emits each
⚡ Watch CVE-2026-52833
Get an email if CVE-2026-52833 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-52833)