CVE-2026-67180CWE-78command-injection

CVE-2026-67180

High · published August 11, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00161 · 4.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-11T20:17Z
References (4)
https://github.com/google/turbinia/issues/1629 · 9119a7d8-5eab-497f-8521-727c672e3725https://github.com/google/turbinia/pull/1631 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-223-02.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-67180 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 11 AUG 15:56Z
    Google Turbinia arbitrary command execution
    cvelistv5