Severity: important
Affected versions:
- Apache InLong 2.0.0 before 2.4.0
Description:
Improper Neutralization of Argument Delimiters in a Command ('Argument
Injection') vulnerability in Apache InLong. Agent Installer's
ModuleManager executes arbitrary shell
commands via ExcuteLinux.exeCmd() with no filtering or whitelist
validation.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick
[1]/[2] to solve it.
[1] https://github.com/apache/inlong/pull/12151 .
[2] https://github.com/apache/inlong/pull/12155 .
Credit:
IcySun (finder)
References:
https://inlong.apache.orghttps://www.cve.org/CVERecord?id=CVE-2026-63046
Best wishes,
Charles Zhang
from Apache InLong
