CVE-2026-33310 Intake has a Command Injection via shell() Expansion in Parameter Defaults

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

CVE-2026-33310

CVE-2026-33310 affects the Intake data-handling package. Before version 2.0.9, the shell() syntax used in parameter defaults could be expanded during catalog parsing, allowing embedded commands to execute when a malicious YAML catalog is loaded or accessed. This creates a potential command-inject...