CVE-2026-33310
2 advisories.
PyPI/intake CVE-2026-33310: high 8.8, EPSS 0.51%
Intake has a Command Injection via shell() Expansion in Parameter Defaults
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.0.9 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-37g4-qqqv-7m99
- https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99
- https://nvd.nist.gov/vuln/detail/CVE-2026-33310
- https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b
- https://github.com/intake/intake
CVE-2026-33310 · published · modified · JSON
PyPI/intake CVE-2026-33310: high 8.8, EPSS 0.51%
Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during t
Action: Upgrade intake to 2.0.9 or later.
pip install intake==2.0.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.9 | - |
Fixed versions
| 2.0.9 |
Sources
- osv: PYSEC-2026-2185
- https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b
- https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99
CVE-2026-33310 · published · modified · JSON