CVE-2024-31866

CVE-2024-31866 is an Apache Zeppelin vulnerability: improper encoding/escaping of output allowing an attacker to override configuration (notably ZEPPELIN_INTP_CLASSPATH_OVERRIDES) to execute shell commands or malicious code. Affects Zeppelin releases from 0.8.2 up to but not including 0.11.1; upg...

CVE-2024-31866 Apache Zeppelin: Interpreter download command does not escape malicious code injection

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELININTPCLASSPATHOVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to...