{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/nuclio/nuclio","cve_ids":["CVE-2026-52833"],"ecosystem":"Go","epss":0.00552,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3v79-m2cg-89ww","id":"tcs_01M5KGR7Z72RQ33G62669JM4FQ","modified_at":"2026-07-21T19:15:35.981863135Z","published_at":"2026-07-17T19:42:05Z","references":["https://osv.dev/vulnerability/GO-2026-6004","https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww","https://github.com/nuclio/nuclio/commit/4c78040c759068e927f3ed7c6507543c15d4ae56","https://github.com/nuclio/nuclio/pull/4149","https://github.com/nuclio/nuclio/releases/tag/1.16.5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6004","url":"https://osv.dev/vulnerability/GO-2026-6004"}],"summary":"Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio"}