Nuclio’s Java runtime uses Go’s text/template to render a build.gradle file when a function is built. The template inserts the runtimeAttributes.repositories[] values using a {{ . }} action that performs no escaping. An attacker can include a closing brace to break out of the repositories block and inject arbitrary Groovy statements. These statements are executed unconditionally during the Gradle configuration phase, allowing remote code execution. The weakness is a classic unescaped template injection (CWE‑94).

All Nuclio deployments running a version older than 1.16.5 are affected, as the vulnerable template logic is present only in those releases.

The CVSS v3.1 score of 8 (High) indicates a serious flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely target the build process during function deployment by supplying malicious runtimeAttributes.repositories values. Successful exploitation grants code execution with the privileges of the build server, potentially compromising the entire Nuclio environment.