CVE-2026-33414

HIGH7.8EPSS 0.02%

PowerShell Command Injection in Podman HyperV Machine

Published: 4/14/2026Modified: 5/5/2026

Description

## Summary A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing `$()` subexpression injection. ## Affected Code **File**: `pkg/machine/hyperv/stubber.go:647` ```go resize := exec.Command("powershell", []string{ "-command", fmt.Sprintf("Resize-VHD \"%s\" %d", imagePath.GetPath(), newSize.ToBytes()), }...) ``` ## Root Cause PowerShell evaluates `$()` subexpressions inside double-quoted strings before executing the outer command. The `fmt.Sprintf` call places the user-controlled image path directly into double quotes without escaping or sanitization. ## Impact An attacker who can control the VM image path (through a crafted machine name or image directory) can execute arbitrary PowerShell commands with the privileges of the Podman process on the Windows host. On typical Windows installations, this means SYSTEM-level code execution. ## Patch https://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed The affected code is only used on Windows, all other operating systems are not affected by this and can thus ignore the CVE patch. ## Credit We like to thank Sang-Hoon Choi (@KoreaSecurity) for reporting this issue to us.

Affected packages (3)

CVSS scores

SourceVersionSeverityVector
osvCVSS 4.0—CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
osvCVSS 3.1HIGH7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References (5)