Description
The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses `subprocess.Popen()` with `shell=True` parameter to execute shell commands, and the user-supplied `chartName` parameter is directly concatenated into the command string without any sanitization or validation. An attacker can inject arbitrary shell commands by crafting a malicious `chartName` parameter value.
INFO
Published Date :
2026-04-13T00:00:00.000Z
Last Modified :
2026-04-15T15:29:31.750Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2026-29955 vulnerability.
| Vendors | Products |
|---|---|
| Cloudark |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-29955.
