[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9fc248fc-3ad7-6556-8cd3-b964910f50ea@apache.org>
Date: Tue, 14 Jul 2026 03:29:39 +0000
From: Li Yang <liyang@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-62392: Apache Kylin: OS Command Injection via Async Query
API
Severity: important
Affected versions:
- Apache Kylin 4 through 5.0.3
Description:
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line.
This issue affects Apache Kylin: from 4 through 5.0.3.
Users are recommended to upgrade to version 5.0.4, which fixes the issue.
This issue is being tracked as KYLIN-6091
Credit:
Suraj Kattimuttathu Suresh <sksuraj@...b.edu> (finder)
References:
https://kylin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-62392
https://issues.apache.org/jira/browse/KYLIN-6091
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
