{"id":"CVE-2026-33414","aliases":["GHSA-hc8w-h2mf-hp59","GO-2026-5421"],"url":"https://o3.security/vulnerability/CVE-2026-33414","summary":"PowerShell Command Injection in Podman HyperV Machine","details":"## Summary\n\nA command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing `$()` subexpression injection.\n\n## Affected Code\n\n**File**: `pkg/machine/hyperv/stubber.go:647`\n\n```go\nresize := exec.Command(\"powershell\", []string{\n    \"-command\",\n    fmt.Sprintf(\"Resize-VHD \\\"%s\\\" %d\", imagePath.GetPath(), newSize.ToBytes()),\n}...)\n```\n\n\n\n## Root Cause\n\nPowerShell evaluates `$()` subexpressions inside double-quoted strings before executing the outer command. The `fmt.Sprintf` call places the user-controlled image path directly into double quotes without escaping or sanitization.\n\n## Impact\n\nAn attacker who can control the VM image path (through a crafted machine name or image directory) can execute arbitrary PowerShell commands with the privileges of the Podman process on the Windows host. On typical Windows installations, this means SYSTEM-level code execution.\n\n\n## Patch\n\nhttps://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed\n\nThe affected code is only used on Windows, all other operating systems are not affected by this and can thus ignore the CVE patch.\n\n## Credit\n\nWe like to thank Sang-Hoon Choi (@KoreaSecurity) for reporting this issue to us.","published":"2026-04-14T22:42:19.822Z","modified":"2026-08-12T03:51:31.527709096Z","cvss":null,"epss":{"score":0.00607,"percentile":0.47545,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/containers/podman/v4","fixedVersion":null},{"ecosystem":"Go","name":"github.com/containers/podman/v5","fixedVersion":"5.8.2"}],"fix":{"url":"https://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed","label":"containers/podman@571c842"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33414.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8211"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-33414"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33414.json"},{"type":"ADVISORY","url":"https://github.com/containers/podman/security/advisories/GHSA-hc8w-h2mf-hp59"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33414"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458522"},{"type":"FIX","url":"https://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed"},{"type":"PACKAGE","url":"https://github.com/containers/podman"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:31.527709096Z"}}