CVE-2026-52833

CVE-2026-52833 is a code-injection flaw (CWE-94) in the Java runtime of the Nuclio serverless framework, which generates a build.gradle file using Go's text/template package when functions are built. Because values from runtimeAttributes.repositories[] are rendered with the unescaped {{ . }} action, an attacker who can set those values can insert a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute during the Gradle configuration phase. Successful injection yields code execution in the function build process, and the CVSS scoring (scope changed, high confidentiality/integrity/availability) indicates the impact can extend beyond the vulnerable component, such as to the build environment or built artifacts. Only Nuclio deployments prior to version 1.16.5 that build functions with the Java runtime are affected, and the high-privilege requirement means the attacker needs the ability to influence function build settings. No exploitation has been reported: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade to Nuclio 1.16.5 or later, prioritizing environments where functions are built with the Java runtime. Until upgraded, restrict and validate runtimeAttributes.repositories values and limit which users can define or modify function build settings, given the high-privilege requirement. Also review recently built Java functions for untrusted or unexpected repository entries.