Executive brief
Fission is a framework used to run serverless functions on Kubernetes. A security flaw in the builder component allowed users with permission to create or update environment configurations to execute unauthorized commands within the system's build environment. This could allow an attacker to view or modify application code packages before they are deployed, potentially compromising the integrity of functions running on the platform.
Technical details
A command injection vulnerability existed in `pkg/builder/builder.go` where `Environment.spec.builder.command` was passed directly to `exec.Command()` after a simple `strings.Fields` split without validation. An attacker with permissions to create or update Environment Custom Resource Definitions (CRDs) could specify arbitrary executables (e.g., `/bin/sh`) and arguments. This allows for arbitrary code execution within the builder pod's context, enabling the attacker to read or modify package deployment archives in the shared `/packages` volume. The issue was addressed in version 1.23.0 by implementing `Builder.resolveBuildCommand` to validate executable paths and reject relative paths or whitespace metacharacters.
Affected products
- Fission Fission <= v1.22.0
Timeline
- 2026-05-07: patched: Security fixes merged in PR #3364
- 2026-05-15: advisory: GitHub Security Advisory GHSA-7pjr-qpvh-m339 published
- 2026-06-10: disclosed: CVE-2026-46618 published to NVD