Поиск уязвимостей
Количество 9
Количество 9
BDU:2026-15907
Уязвимость файла pkg/machine/hyperv/stubber.go программного средства управления и запуска OCI-контейнеров Podman, позволяющая нарушителю выполнить произвольные команды
ALT-PU-2026-11781
ALT-PU-2026-11781: package `podman` update to version 5.8.5-alt1
CVE-2026-33414
Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.
CVE-2026-33414
Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.
CVE-2026-33414
Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.
CVE-2026-33414
Podman is a tool for managing OCI containers and pods. Versions 4.8.0 ...
ROS-20260813-80-0003
Уязвимость podman
ROS-20260813-73-0003
Уязвимость podman
GHSA-hc8w-h2mf-hp59
PowerShell Command Injection in Podman HyperV Machine
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-15907 Уязвимость файла pkg/machine/hyperv/stubber.go программного средства управления и запуска OCI-контейнеров Podman, позволяющая нарушителю выполнить произвольные команды | CVSS3: 6.4 | 1% Низкий | 7 месяцев назад |
| ALT-PU-2026-11781 ALT-PU-2026-11781: package `podman` update to version 5.8.5-alt1 | CVSS3: 7.8 | 3 месяца назад | |
 | CVE-2026-33414 Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2. | CVSS3: 7.8 | 1% Низкий | 7 месяцев назад |
 | CVE-2026-33414 Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2. | CVSS3: 8.8 | 1% Низкий | 7 месяцев назад |
 | CVE-2026-33414 Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2. | CVSS3: 7.8 | 1% Низкий | 7 месяцев назад |
| CVE-2026-33414 Podman is a tool for managing OCI containers and pods. Versions 4.8.0 ... | CVSS3: 7.8 | 1% Низкий | 7 месяцев назад |
 | ROS-20260813-80-0003 Уязвимость podman | CVSS3: 6.4 | 1% Низкий | 3 месяца назад |
| ROS-20260813-73-0003 Уязвимость podman | CVSS3: 6.4 | 1% Низкий | 3 месяца назад |
| GHSA-hc8w-h2mf-hp59 PowerShell Command Injection in Podman HyperV Machine | CVSS3: 7.8 | 1% Низкий | 7 месяцев назад |
Уязвимостей на страницу