Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/nuclio/nuclio

5 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v1.14.2 (Feb 25, 2025): affected by 3 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
5 · 4 high, 1 medium
Releases
1 since v1.14.2 (Feb 25, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

    Affected: fixed in 0.0.0-20260601075854-3356b86a8bfa.

    Fixed in v1.14.2 (released Feb 25, 2025, 554 days before disclosure, the advisory names 0.0.0-20260601075854-3356b86a8bfa, which was never published).

    The latest release, v1.14.2, is not affected.

  • Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

    Affected: fixed in 1.16.5; all versions.

    No fix released. The latest release, v1.14.2, is still affected.

  • CVE-2026-52832Medium 4.9

    Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

    Affected: fixed in 1.16.5; all versions.

    No fix released. The latest release, v1.14.2, is still affected.

  • Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

    Affected: fixed in 0.0.0-20260513101907-1915cd26d514.

    Fixed in v1.14.2 (released Feb 25, 2025, 554 days before disclosure, the advisory names 0.0.0-20260513101907-1915cd26d514, which was never published).

    The latest release, v1.14.2, is not affected.

  • Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

    Affected: all versions; fixed in 1.15.20.

    No fix released. The latest release, v1.14.2, is still affected.