kubectl ANSI escape characters not filtered

BASSO 3.0CVE-2021-25743 · GHSA-f9jg-8p32-2f55 · GO-2022-0983 · Published 07/01/2022 · updated 17/06/2026

In breve

CVE-2021-25743 è una vulnerabilità BASSO (CVSS 3.0) che riguarda k8s.io/kubernetes, kubernetes (kubernetes).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.84%, superiore al 58.0% delle vulnerabilità.
Correzione: aggiornare a 1.26.0-alpha.3 o successiva.

Package	Affected versions	Patched versions
k8s.io/kubernetes Go	`< 1.26.0-alpha.3`	`1.26.0-alpha.3`
kubernetes kubernetes	`= 1.26.0≤ 1.25.0`	No fix yet

Description

kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

NVD description

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.