CVE-2026-105014

Summary

Azure Pipelines suffers from command injection due to improper neutralization of special characters in user-supplied input, allowing an unauthenticated remote attacker to execute arbitrary commands on the underlying system.

Exploitability

Exploitation is straightforward over the network with no authentication required, assuming the vulnerable endpoint is exposed and accepts unsanitized user input.

Blast radius

Successful exploitation could lead to full compromise of the Azure Pipelines server, including unauthorized code execution, data exfiltration, and potential lateral movement within the CI/CD infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Azure Pipelines version 2.590 or later, as this is the fixed version specified in the advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.