Detections
Analytics

Podman 4.8.0 < 5.8.2 PowerShell Command Injection (GHSA-hc8w-h2mf-hp59)

high Nessus Plugin ID 320124

Synopsis

A container management application installed on the remote Windows host is affected by a command injection vulnerability.

Description

The version of Podman installed on the remote Windows host is prior to 5.8.2. It is, therefore, affected by a command injection vulnerability in the HyperV machine backend.

 - A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. An attacker who can control the VM image path can execute arbitrary PowerShell commands with the privileges of the Podman process on the Windows host. (CVE-2026-33414)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Podman version 5.8.2 or later.

See Also

http://www.nessus.org/u?32caea60

Plugin Details

Severity: High

ID: 320124

File Name: podman_5_8_2.nasl

Version: 1.2

Type: Local

Agent: windows

Family: Windows

Published: 6/9/2026

Updated: 6/10/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33414

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:podman_project:podman

Required KB Items: installed_sw/Cloud Native Computing Foundation Podman

Exploit Ease: No known exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-33414

IAVA: 2026-A-0355