Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.

The version of Podman installed on the remote Windows host is prior to 5.8.2. It is, therefore, affected by a command injection vulnerability in the HyperV machine backend.

  - A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a     PowerShell double-quoted string without sanitization, allowing $() subexpression injection. An attacker who can     control the VM image path can execute arbitrary PowerShell commands with the privileges of the Podman process on     the Windows host. (CVE-2026-33414)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command     injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image     path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression     injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the     outer command, an attacker who can control the VM image path through a crafted machine name or image     directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical     Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is     exclusive to the HyperV backend. This issue has been patched in version 5.8.2. (CVE-2026-33414)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command
    injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image
    path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression
    injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the
    outer command, an attacker who can control the VM image path through a crafted machine name or image
    directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical
    Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is
    exclusive to the HyperV backend. This issue has been patched in version 5.8.2. (CVE-2026-33414)

ID	Name	Product	Family	Type	Severity
320124	Podman 4.8.0 < 5.8.2 PowerShell Command Injection (GHSA-hc8w-h2mf-hp59)	Nessus	Windows	Local	high
306623	Linux Distros Unpatched Vulnerability : CVE-2026-33414	Nessus	Misc.	Local	high
440359	SCA: security update for github.com/containers/podman/v5 (GHSA-hc8w-h2mf-hp59)	Tenable Cloud Security	SCA Checks	Local	high
440359	SCA: security update for github.com/containers/podman/v5 (GHSA-hc8w-h2mf-hp59)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-33414

high

Tenable Plugins

high

high

high

high