CVE-2026-52833

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.

• CWE-94

• https://github.com/nuclio/nuclio/commit/4c78040c759068e927f3ed7c6507543c15d4ae56
• https://github.com/nuclio/nuclio/pull/4149
• https://github.com/nuclio/nuclio/releases/tag/1.16.5
• https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww
• https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52828Kimai is an open-source time tracking application. Prior to …5.3
• CVE-2026-52829ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…7.5
• CVE-2026-5283Inappropriate implementation in ANGLE in Google Chrome prior…6.5
• CVE-2026-52830fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1,…9.4
• CVE-2026-52831Nuclio is a "Serverless" framework for Real-Time Events and …8
• CVE-2026-52832Nuclio is a "Serverless" framework for Real-Time Events and …4.9
• CVE-2026-52834jxl-oxide is a pure Rust implementation of a JPEG XL decoder…7.3
• CVE-2026-52835Tautulli is a Python based monitoring and tracking tool for …7
• CVE-2026-52836OpenDDS is an open source C++ implementation of the Object M…8.7
• CVE-2026-52837Easy!Appointments is a self hosted appointment scheduler. In…6.9
• CVE-2026-52838Easy!Appointments is a self hosted appointment scheduler. Ve…2.6
• CVE-2026-52839Easy!Appointments is a self hosted appointment scheduler. Ve…3.3