title: Apache Kylin: Command injection by Useless configuration
description: In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
problem types: Command injection
affected:
{
defaultStatus: unaffected
product: Apache Kylin
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 4.0.2, status: affected, version: Apache Kylin 4, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]
workarounds: Users of Kylin 2.x & Kylin 3.x & 4.x should upgrade to 4.0.3 or apply patch  https://github.com/apache/kylin/pull/2011 https://github.com/apache/kylin/pull/2011