CVE-2026-63046

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it. [1] https://github.com/apache/inlong/pull/12151 . [2] https://github.com/apache/inlong/pull/12155 .

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

History

16 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Neutralización Inadecuada de Delimitadores de Argumentos en un Comando ('Inyección de Argumentos') en Apache InLong. El ModuleManager del Instalador del Agente ejecuta comandos de shell arbitrarios a través de ExcuteLinux.exeCmd() sin filtrado ni validación de lista blanca. Este problema afecta a Apache InLong: desde 2.0.0 antes de 2.4.0. Se aconseja a los usuarios actualizar a la versión 2.4.0 de Apache InLong o aplicar los parches [1]/[2] para solucionarlo. [1] https://github.com/apache/inlong/pull/12151 . [2] https://github.com/apache/inlong/pull/12155 .

Information

Published : 2026-08-21 09:16

Updated : 2026-10-16 15:10

NVD link : CVE-2026-63046

Mitre link : CVE-2026-63046

CVE.ORG link : CVE-2026-63046

JSON object : View

Products Affected

apache

inlong

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-63046", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63046", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T18:42:12.487102Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache InLong", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T09:16:40.083", "references": [{"url": "https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong.\u00a0Agent Installer's ModuleManager executes arbitrary shell\ncommands via ExcuteLinux.exeCmd() with no filtering or whitelist\nvalidation. \n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12151 .\n\n[2]\u00a0 https://github.com/apache/inlong/pull/12155 ."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Delimitadores de Argumentos en un Comando ('Inyecci\u00f3n de Argumentos') en Apache InLong. El ModuleManager del Instalador del Agente ejecuta comandos de shell arbitrarios a trav\u00e9s de ExcuteLinux.exeCmd() sin filtrado ni validaci\u00f3n de lista blanca.\n\nEste problema afecta a Apache InLong: desde 2.0.0 antes de 2.4.0.\n\nSe aconseja a los usuarios actualizar a la versi\u00f3n 2.4.0 de Apache InLong o aplicar los parches [1]/[2] para solucionarlo.\n\n[1] https://github.com/apache/inlong/pull/12151 .\n\n[2] https://github.com/apache/inlong/pull/12155 ."}], "lastModified": "2026-10-16T15:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A21FED1B-A1E2-4CF8-88D4-A020ADBCA50F", "versionEndExcluding": "2.4.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}