undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Products covered
Azure CycleCloud 8.9.1
Remediation
Release Notes
Vendor-listed fixes
8.9.2
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Removed affected products: Azure CycleCloud 8.9.2.
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.