Executive brief
Google Turbinia is a digital forensics framework used to process and analyze forensic evidence at scale. An attacker who can submit a processing request with a malicious evidence path can execute arbitrary commands on Turbinia worker machines, which typically run with elevated privileges and have access to sensitive forensic data and credentials. This leads to complete compromise of the forensic analysis environment.
Technical details
The vulnerability is a command injection (CWE-78) in multiple Turbinia worker tasks (grep.py, strings.py, photorec.py) that construct shell commands by string-formatting evidence paths directly into command strings, then execute them with shell=True. The evidence.local_path and evidence.device_path fields originate from API request bodies, allowing an attacker who can submit or influence a processing request to inject shell metacharacters (e.g., "; malicious_command; #") into the path. Since worker processes typically run as root and process untrusted forensic evidence, successful injection yields root-level remote code execution on the worker fleet. The fix involves passing commands as argument lists with shell=False instead of interpolating paths into shell strings, and validating/normalizing evidence paths.
Affected products
- Google Turbinia prior to 2026-07-10 fix
Timeline
- 2026-06-11: disclosed: Issue opened on GitHub
- 2026-07-10: patched
- 2026-08-11: advisory: CVE-2026-67180 published