Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
Date: 2026-05
Affected: go/github.com/fission/fission
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-46618
CWE: CWE-250
CWE-269
CWE-78

### Summary Before the round-1 security sweep, `pkg/builder/builder.go` passed `Environment.spec.builder.command` directly into `exec.Command(...)` after a `strings.Fields` split, with no validation of the executable path or its arguments. A user who could create or update `Environment` CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. `/bin/sh -c '...'`) and execute arbitrary code in the builder pod context. ### Affected component - `pkg/builder/builder.go:254` — call site (`exec.Command(buildCmd, buildArgs...)`). - `pkg/builder/builder.go:106` — input source: `buildCmd, buildArgs = strings.Fields(req.BuildCommand)[0], strings.Fields(req.BuildCommand)[1:]`. ### Impact A subject with `create` / `update` privilege on `Environment` objects could: 1. Cause the builder pod for any package using that environment to execute arbitrary code. 2. Read whatever files the builder pod has access to inside its `/packages` shared volume (deployment archive payloads for that package). 3. Write arbitrary content into the `/packages` shared volume, which the fetcher subsequently uploads as the package deployment archive. The builder pod runs in the user's namespace with the `fission-builder` SA (not the more-privileged executor SA), so the impact is bounded to that namespace's package contents and the builder pod's own filesystem. `PR:H` reflects that creating / modifying `Environment` CRDs is typically re


Mitigations:

Architectural layers (MAESTRO):