The vulnerability is located in builder.go where Environment.spec.builder.command is passed directly to exec.Command after a strings.Fields split, without validating the executable path or its arguments. An attacker who can create or update Environment Custom Resource Definitions in a namespace that the builder manager monitors can set builder.command to any executable inside the builder image, such as '/bin/sh -c ...', thereby running arbitrary code inside the builder pod’s context. This grants full control of the pod and potentially escalated access to the underlying Kubernetes cluster.

Affected product is Fission, an open‑source, Kubernetes‑native serverless framework. All versions released prior to v1.23.0 are vulnerable. The issue was addressed in the v1.23.0 release.

The CVSS score of 6.9 denotes moderate severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires the ability to create or modify Environment CRDs in namespaces observed by the builder manager, indicating that a typical attack vector would involve privileged control over cluster resources rather than external network reach.