Homepage

CRLF Injection Affecting incus-feature package, versions <6.21.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.47% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE323-INCUSFEATURE-15091591
  • published25 Jan 2026
  • disclosed22 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 22 Jan 2026

CVE-2026-23953  (opens in a new tab)
CWE-93  (opens in a new tab)

How to fix?

Upgrade Alpine:3.23 incus-feature to version 6.21.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream incus-feature package and not the incus-feature package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privileged action for validation only). A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication.