Executive brief
Apache InLong is a data integration platform used to manage data pipelines and agent installations. The Agent Installer's ModuleManager component fails to properly validate shell command arguments, allowing an attacker to inject arbitrary commands and execute them with the privileges of the installer process, potentially compromising the entire data pipeline infrastructure.
Technical details
This vulnerability is an argument injection flaw (CWE-88) in the ExcuteLinux.exeCmd() method of Apache InLong's Agent Installer ModuleManager, which constructs and executes shell commands without filtering or whitelist validation of user-supplied arguments. The vulnerable component directly interpolates user input into shell commands, enabling an attacker to break out of the intended command context and inject arbitrary shell metacharacters and commands. Network reachability and authentication status depend on how ModuleManager is exposed; typical exploitation requires local or adjacent network access to the installer component. A successful attack allows arbitrary command execution with the privileges of the InLong process. Patches are available in Apache InLong 2.4.0 and via cherry-picked commits in the project repository.
Affected products
- Apache InLong 2.0.0 to 2.3.x
Timeline
- 2026-08-21: disclosed
- 2026-08-21: patched: Fix available in version 2.4.0 and via pull requests #12151 and #12155