{"id":"CVE-2026-62392","published":"2026-07-14T12:18:57Z","modified":"2026-07-15T04:00:58Z","title":"Apache Kylin: OS Command Injection via Async Query API","vendor":"Apache","product":"Apache Kylin","tier":"tail","description":{"text":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line.\n\nThis issue affects Apache Kylin: from 4 through 5.0.3.\n\nUsers are recommended to upgrade to version 5.0.4, which fixes the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02481,"percentile":0.84522,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://lists.apache.org/thread/9hof8lxo3mzshsh5r77mskzqlkns09gn","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/14/5","tags":[]}],"priority":{"score":23.1,"factors":[{"name":"EPSS percentile","points":16.9},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Kylin","versions":[">= 4, <= 5.0.3"]}],"euvd":{"id":"EUVD-2026-43664","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-apache-kylin-cwe-78"}}