Nuclio's Java runtime generates a "build.gradle" file during function builds using Go's "text/template" package. The template renders "runtimeAttributes.repositories[]" values with the "{{ . }}" action, which performs no escaping. An attacker can embed a closing brace ("}") to break out of the "repositories {}" block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. The Dashboard API runs with NOP authentication by default, so no credentials are required. The build container runs as root. The injected command output confirmed by dynamic testing: - CWE: CWE-94 (Improper Control of Generation of Code / Code Injection) - Affected versions: Nuclio <= 1.15.27 (latest as of 2026-05-17, dynamically verified) ***