CVE-2026-62392

Опубликовано: 14 июл. 2026

Источник: nvd

CVSS3: 9.8

CVSS3: 8.8

EPSS Низкий

Описание

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line.

This issue affects Apache Kylin: from 4 through 5.0.3.

Users are recommended to upgrade to version 5.0.4, which fixes the issue.

Ссылки

https://lists.apache.org/thread/9hof8lxo3mzshsh5r77mskzqlkns09gn
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/14/5
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 5.0.4 (исключая)

EPSS

Процентиль: 68%

0.01321

Низкий

9.8 Critical

CVSS3

8.8 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

GHSA-vv75-pcv7-p758

CVSS3: 9.8

github

29 дней назад

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

EPSS

Процентиль: 68%

0.01321

Низкий

9.8 Critical

CVSS3

8.8 High

CVSS3

Дефекты

CWE-78