Intake has a Command Injection via shell() Expansion in Parameter Defaults
Date: 2026-03
Affected: pip/intake
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33310
CWE: CWE-78
CWE-94
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

### Summary The shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. This behavior could potentially be classified as OS Command Injection / Unsafe Shell Expansion. ### Details The issue appears to originate from how parameter default values are expanded when a catalog source is accessed. During catalog loading and source access: Intake resolves parameter default values The function responsible for expanding defaults processes the shell() syntax The shell expression triggers a subprocess execution Because this occurs during catalog evaluation, the command may execute before the user explicitly interacts with the dataset itself. Affected logic appears to involve: ``` expand_defaults() ``` and related parameter parsing mechanisms. ### PoC exploit.yaml ``` metadata: version: 1 sources: rce_test: driver: csv description: "Testing shell expansion in parameters" args: urlpath: "{{ cmd_exec }}" parameters: cmd_exec: display_name: "Test Parameter" type: str default: "shell(touch /tmp/intake_rce_test)" ``` reproduce.py ``` import intake import os PROOF_FILE = "/tmp/intake_rce_test" if os.path.exists(PROOF_FILE):


Mitigations:

Architectural layers (MAESTRO):