High severity8.8NVD Advisory· Published Apr 13, 2026· Updated Jun 17, 2026
CVE-2026-29955
CVE-2026-29955
Description
The /registercrd endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses subprocess.Popen() with shell=True parameter to execute shell commands, and the user-supplied chartName parameter is directly concatenated into the command string without any sanitization or validation. An attacker can inject arbitrary shell commands by crafting a malicious chartName parameter value.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <4.14
Patches
Vulnerability mechanics
References
2- gist.github.com/b0b0haha/f011fdd69adc3ae272a4e3b99af90163nvdExploitThird Party Advisory
- github.com/b0b0haha/CVE-2026-29955/blob/main/README.mdnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.