CVE-2026-63046

EUVD-2026-63849

21.08.2026, 09:16

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell
commands via ExcuteLinux.exeCmd() with no filtering or whitelist
validation. 

This issue affects Apache InLong: from 2.0.0 before 2.4.0.



Users are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1]/[2] to solve it.

[1]  https://github.com/apache/inlong/pull/12151 .

[2]  https://github.com/apache/inlong/pull/12155 .

Argument Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 6.13%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	inlong	2.0.0 ≤ 𝑥 < 2.4.0	CNA

Common Weakness Enumeration

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References

https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y