Google Turbinia contains an OS command injection vulnerability (CWE-78) that permits arbitrary command execution through worker tasks. Attackers who have privileges to submit processing requests or manipulate evidence path or name parameters can exploit this flaw to execute arbitrary code on the worker fleet. The vulnerability was addressed with a fix released on 2026-07-10. No specific affected versions were provided. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary commands on the worker fleet, potentially leading to full compromise of the affected systems. This impacts confidentiality, integrity, and availability of the Turbinia environment.

A fix for this vulnerability was released on 2026-07-10. Users should apply the official patch or update to the fixed version as provided by Google. Since no specific affected versions or patch links are provided here, users must consult the official Google Turbinia advisories or repositories to obtain and apply the fix.