CVE-2026-33414

OVERVIEW Podman versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend where unsanitized VM image paths enable PowerShell subexpression injection. An attacker controlling the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands. The vulnerability is exclusive to Windows systems using the HyperV backend and has been patched in version 5.8.2. SEVERITY The vulnerability presents a high-impact threat with a local attack vector and low complexity. An attacker with the ability to influence VM image paths can achieve SYSTEM-level code execution on typical Windows installations, representing complete system compromise. The relatively low EPSS score of 0.0004 suggests limited prevalence in current threat landscapes, though the potential impact remains severe for affected deployments. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the CVE's inactive status on threat feeds and its absence from the Known Exploited Vulnerabilities catalog. No public exploit code availability is documented. Community attention appears limited given the specialized nature of the vulnerability, restricted platform scope, and the availability of a timely patch.