CVE-2026-91006

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...