CVE-2026-81662

Code injection via untrusted config keys in Flowintel alert settings update endpoint.

• CVSS 8.6
• 20
• Input Validation and Sanitization
• Remote

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment: f'{key} = {py_val}' and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. Version impacted >=3.3.0

CVE

CVE-2026-81662

CWE

20

CVSS base score

8.6

Published

2026-08-27

OWASP

A03 Injection

Orthogonal defect classification

Assignment

Code defect classification

Incorrect Assignment

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python 3.3.0

Solution

Upgrade Flowintel to v3.4.0 (or later), where the configuration‑key handling in the alerts settings endpoint is properly sanitized.

import importlib
import ast
import os

CONFIG_PATH = os.path.join(os.path.dirname(__file__), 'conf', 'config_module.py')


def update_alerts_settings(updates: dict):
    """
    Apply a dict of configuration updates to conf/config_module.py.
    """
    # Load current file
    with open(CONFIG_PATH, 'r') as f:
        lines = f.readlines()

    # Build a mapping of existing keys to line numbers
    existing = {}
    for idx, line in enumerate(lines):
        if line.strip() and not line.lstrip().startswith('#'):
            parts = line.split('=', 1)
            if len(parts) == 2:
                existing[parts[0].strip()] = idx

    # Apply updates
    for key, val in updates.items():
        py_val = ast.literal_eval(repr(val))  # normalize to Python literal
        # VULNERABLE: directly interpolates untrusted key into code
        assignment = f'{key} = {py_val}\n'
        if key in existing:
            lines[existing[key]] = assignment
        else:
            lines.append(assignment)

    # Write back the modified module
    with open(CONFIG_PATH, 'w') as f:
        f.writelines(lines)

    # Reload the module so changes take effect
    import conf.config_module as cfg
    importlib.reload(cfg)

import importlib
import ast
import os
import re

CONFIG_PATH = os.path.join(os.path.dirname(__file__), 'conf', 'config_module.py')
# Allow only alphanumeric identifiers and underscores for config keys
_KEY_PATTERN = re.compile(r'^[A-Za-z_][A-Za-z0-9_]*$')


def update_alerts_settings(updates: dict):
    """
    Apply a dict of configuration updates to conf/config_module.py.
    """
    with open(CONFIG_PATH, 'r') as f:
        lines = f.readlines()

    existing = {}
    for idx, line in enumerate(lines):
        if line.strip() and not line.lstrip().startswith('#'):
            parts = line.split('=', 1)
            if len(parts) == 2:
                existing[parts[0].strip()] = idx

    for key, val in updates.items():
        if not _KEY_PATTERN.match(key):
            # FIX: reject keys that are not valid Python identifiers
            raise ValueError(f'Invalid configuration key: {key}')
        py_val = ast.literal_eval(repr(val))
        # FIX: safely construct assignment using a validated key
        assignment = f'{key} = {py_val}\n'
        if key in existing:
            lines[existing[key]] = assignment
        else:
            lines.append(assignment)

    with open(CONFIG_PATH, 'w') as f:
        f.writelines(lines)

    import conf.config_module as cfg
    importlib.reload(cfg)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202681662,
  title        = {{Code injection via untrusted config keys in Flowintel alert settings update endpoint.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-81662},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-81662/}}
}