CVE-2026-123084

The Pulpcore package contains an expression language injection vulnerability in the HeaderContentGuard.permit function within publication.py. The component fails to restrict jq filters to header values only, allowing them to access the process environment via the env builtin. A low-privileged net...