{"action":"Upgrade github.com/nuclio/nuclio to 0.0.0-20260601075854-3356b86a8bfa or later.","affected":[{"introduced":"0"}],"component":"github.com/nuclio/nuclio","cve_ids":["CVE-2026-52831"],"ecosystem":"Go","epss":0.00534,"exploited":false,"fixed_versions":["0.0.0-20260601075854-3356b86a8bfa"],"ghsa_id":"GHSA-v5px-423j-pf7p","id":"tcs_01M5KFNME8PXE7RXXSFREWX0MW","modified_at":"2026-07-21T19:19:02.405438785Z","published_at":"2026-07-08T20:24:20Z","references":["https://osv.dev/vulnerability/GHSA-v5px-423j-pf7p","https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p","https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede","https://github.com/nuclio/nuclio","https://github.com/nuclio/nuclio/releases/tag/1.16.4"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-v5px-423j-pf7p","url":"https://osv.dev/vulnerability/GHSA-v5px-423j-pf7p"}],"summary":"Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE"}