{"id":"CVE-2024-33396","aliases":["EUVD-2024-1826","GHSA-wccg-v638-j9q2","GO-2024-2817"],"status":"published","title":"karmada vulnerable to arbitrary code execution via a crafted command","description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00185,"percentile":0.08181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2024-05-02T00:00:00Z","modified":"2026-11-09T15:17:02Z","affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/karmada-io/karmada","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/karmada-io/karmada","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/karmada-io/karmada","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"karmada-io","product":"karmada"}],"references":[{"url":"https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50","tags":["x_transferred","web"]},{"url":"https://github.com/github/advisory-database/pull/10318"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33396","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wccg-v638-j9q2","tags":["advisory"]},{"url":"https://github.com/karmada-io/karmada","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-33396","description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.","status":"published","published":"2024-05-02T00:00:00Z","modified":"2026-11-09T14:51:36.335Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-09T15:33:44.265689Z"}],"euvd":[{"id":"EUVD-2024-1826","description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.","status":"published","published":"2024-05-02T00:00:00Z","modified":"2026-11-09T14:51:36Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-09T16:17:22.482171Z"}],"ghsa":[{"id":"GHSA-wccg-v638-j9q2","title":"karmada vulnerable to arbitrary code execution via a crafted command ","description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T21:30:29Z","modified":"2024-07-03T20:12:35Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2024-33396","description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.","status":"published","published":"2024-05-02T19:15:06.117Z","modified":"2026-11-09T15:17:02.747Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-09T18:15:08.30751Z"}],"osv":[{"id":"GHSA-wccg-v638-j9q2","title":"karmada vulnerable to arbitrary code execution via a crafted command ","description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.","status":"published","published":"2024-05-02T21:30:29Z","modified":"2024-07-03T20:12:34Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"GO-2024-2817","title":"karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada","description":"karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada","status":"published","published":"2024-06-05T15:10:42Z","modified":"2026-03-03T04:55:18.931324Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}