Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.

CVE-2026-52833 affects Nuclio, a serverless framework for real-time events and data processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file using Go's text/template package without proper escaping. The template renders runtimeAttributes.repositories[] values using the {{ . }} action, which performs no sanitization. An attacker can inject a closing brace character to break out of the repositories block and append arbitrary Groovy statements. These malicious statements execute unconditionally during the Gradle configuration phase, enabling potential remote code execution or build environment compromise. The vulnerability is classified as a template injection issue rooted in unsanitized user-controlled input. The issue has been patched in Nuclio version 1.16.5, with fixes available via the official GitHub repository.