CVE-2026-25996

Katalog CVE

CVSS 9.8 · Critical EPSS 0,80%

Kerentanan Improper Neutralization of Escape, Meta, or Control Sequences pada linuxfoundation inspektor gadget. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

Rincian

Terbit di NVD

12 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f exploit · advisory vendor
• https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2 patch
• https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1 product · release notes