CVE-2026-46618

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.23.0

Description In pkg/builder/builder.go, the software passes the Environment.spec.builder.command variable directly into the exec.Command() function after a strings.Fields split without validating the executable path or its arguments. A user with privileges to create or update Environment Custom Resource Definitions (CRDs) in a namespace observed by the buildermgr can point the builder pod to any executable within the builder image, such as /bin/sh -c '...', leading to arbitrary code execution in the builder pod context. This allows the attacker to read files in the /packages shared volume or write arbitrary content into it, which is then uploaded as the package deployment archive. The impact is limited to the user's namespace and the builder pod's filesystem as it runs with the fission-builder ServiceAccount.

Recommendations Update to version 1.23.0. Restrict the ability to create or update Environment CRDs to trusted operators only. Audit Environment.spec.builder.command values for any paths other than /build. Run the buildermgr with a tightened ServiceAccount that lacks secret access in the builder namespace.