Research • Feb 10, 2026

Template injection vector in CI pipeline variables

Analysis of a templating flaw that allows untrusted input to alter build-time commands.

high

CVE

CVE-2026-10001

CWE

CWE-94

Affected Surface

CI pipeline template processors, internal build tools

A variable interpolation bug in CI templates can enable attacker-controlled command fragments.

Impact

This can allow arbitrary command execution in build contexts when unsafe interpolation is used.

Use strict template parsing, command allow-listing, and immutable build inputs.