CVE-2026-33414 is an OS command injection vulnerability in Podman's HyperV machine backend (pkg/machine/hyperv/stubber.go) affecting versions 4.8.0 through 5.8.1. The vulnerability occurs because the VM image path is embedded unsanitized in a PowerShell double-quoted string, enabling subexpression injection via $() syntax. An attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process, which on Windows typically means SYSTEM-level execution. This vulnerability is exclusive to Windows due to the HyperV backend dependency. The issue has been patched in Podman version 5.8.2. The CVSS 4.0 base score is 4.0, indicating medium severity with local attack vector, high complexity, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Vendor advisories from Red Hat confirm the vulnerability and patch availability.

An attacker able to control the VM image path on a Windows system running Podman with the HyperV backend can execute arbitrary PowerShell commands with SYSTEM-level privileges, leading to full system compromise. This elevates the risk of unauthorized code execution and potential system takeover. The vulnerability does not affect non-Windows platforms or Podman versions outside the specified range.

This vulnerability has been fixed in Podman version 5.8.2. Users should upgrade to version 5.8.2 or later to remediate the issue. No additional mitigations are specified by the vendor advisory. Patch status is confirmed by Red Hat advisories linked in the vendor advisory content.