Homepage

CRLF Injection Affecting incus package, versions <6.0.4-2+deb13u4

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.47% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-INCUS-18496039
  • published1 Aug 2026
  • disclosed22 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 22 Jan 2026

CVE-2026-23953  (opens in a new tab)
CWE-93  (opens in a new tab)

How to fix?

Upgrade Echo:latest incus to version 6.0.4-2+deb13u4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream incus package and not the incus package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privileged action for validation only). A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication.