Executive brief
Intake is a Python data cataloging and loading framework used by data scientists and analysts to manage datasets. A command injection vulnerability allows arbitrary code execution when a user loads a malicious catalog YAML file—the embedded shell() commands execute automatically during catalog parsing before the user explicitly accesses the data, potentially compromising the user's system.
Technical details
The vulnerability is an OS command injection (CWE-78) and code injection (CWE-94) flaw in Intake's parameter default value expansion mechanism. When a catalog YAML is parsed, the expand_defaults() function and related parameter processing automatically interprets shell() syntax in parameter default values and executes the enclosed commands via subprocess. The attack requires only that a user loads a malicious YAML catalog (e.g., via intake.open_catalog()), with optional user interaction to access a source—no authentication or elevated privileges needed. An attacker can achieve remote code execution with the privileges of the user running Intake. No patch has been released as of the advisory date; mitigations include disabling shell() expansion by default or requiring explicit opt-in.
Affected products
- Intake Project Intake 0.1.2 through 0.7.0; 2.0.0a1 through 2.0.9
Timeline
- 2026-03-19: disclosed
- 2026-03-24: advisory: NVD publication