CVE-2026-33414

Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33414.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/containers/podman

Affected ranges

Type

GIT

Repo

https://github.com/containers/podman

Events

Introduced

c4dfcf14874479e34b3f312f089fc5840e306258

Fixed

5b263b5f5b48004a87caac44e67349a8266d9ef4

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.8.0"
        },
        {
            "fixed": "5.8.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33414.json"