{"action":"Upgrade github.com/nuclio/nuclio to 0.0.0-20260601075854-3356b86a8bfa or later.","affected":[{"introduced":"0"}],"component":"github.com/nuclio/nuclio","cve_ids":["CVE-2026-52831"],"ecosystem":"Go","epss":0.00534,"exploited":false,"fixed_versions":["0.0.0-20260601075854-3356b86a8bfa"],"ghsa_id":"GHSA-v5px-423j-pf7p","id":"tcs_01M5KGQX693MYKFD4VCD4V42Y0","modified_at":"2026-07-21T19:15:26.340005887Z","published_at":"2026-07-17T19:42:05Z","references":["https://osv.dev/vulnerability/GO-2026-5946","https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p","https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede","https://github.com/nuclio/nuclio/releases/tag/1.16.4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5946","url":"https://osv.dev/vulnerability/GO-2026-5946"}],"summary":"Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE in github.com/nuclio/nuclio"}