Threats tagged 'ghsa-rq96-f9wc-rppm'

The che-machine-exec service has a critical command injection vulnerability due to unsafe concatenation of user-controlled input into shell commands without escaping. When authentication is disabled (the default setting), remote attackers can execute arbitrary code in containers accessible by che-machine-exec via shell command substitution.