Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33310 Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to … https://www.cve.org/CVERecord?id=CVE-2026-33310
Post summary
The post merely announces the existence of CVE-2026-33310 with an incomplete description and a link to the CVE record, lacking specific technical or exploit details.
🟠 CVE-2026-33310 - High Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded... https://www.thehackerwire.com/vulnerability/CVE-2026-33310/ https://t.co/QEMgM4cCPO
Post summary
The post announces the high‑severity CVE‑2026‑33310 in Intake, noting that shell() syntax within default parameters is automatically expanded before version 2.0.9, potentially allowing malicious code execution.
[CVE-2026-33310: HIGH] Intake 2.0.9 release addresses security vulnerability enabling shell command execution via parameter default values in catalog source, enhancing cyber protection.#cve,CVE-2026-33310,#cybersecurity https://cvefind.com/CVE-2026-33310
Post summary
The Intake 2.0.9 release includes a patch for CVE-2026-33310, fixing a shell command execution vulnerability that exploited parameter default values.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | intake | intake | - | - | - |