What is GHSA-jc7r-r7p4-f656?

GHSA-jc7r-r7p4-f656 is a security advisory published by GitHub Security Advisories with unknown severity. Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...

Which CVE IDs does GHSA-jc7r-r7p4-f656 cover?

GHSA-jc7r-r7p4-f656 covers the following CVE IDs: CVE-2026-63046. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-jc7r-r7p4-f656unknown

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...

Vendor

GitHub Security Advisories

Published

August 21, 2026

Last Modified

August 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-63046 →

📋 Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.

[1] https://github.com/apache/inlong/pull/12151 .

[2] https://github.com/apache/inlong/pull/12155 .

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-63046
https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y
https://github.com/advisories/GHSA-jc7r-r7p4-f656