{"id":"CVE-2026-105014","published":"2026-10-22T22:17:52.183","lastModified":"2026-10-24T04:18:16.820","description":"Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Azure Pipelines suffers from command injection due to improper neutralization of special characters in user-supplied input, allowing an unauthenticated remote attacker to execute arbitrary commands on the underlying system.","exploitability":"Exploitation is straightforward over the network with no authentication required, assuming the vulnerable endpoint is exposed and accepts unsanitized user input.","blast_radius":"Successful exploitation could lead to full compromise of the Azure Pipelines server, including unauthorized code execution, data exfiltration, and potential lateral movement within the CI/CD infrastructure.","remediation":"Upgrade to Azure Pipelines version 2.590 or later, as this is the fixed version specified in the advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["command-injection","rce","azure-pipelines","ci-cd","network-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:52:38.204Z"}}