CVE-2026-24905
Command Injection in Inspektor Gadget Image Build Allows Arbitrary Execution
Publication date: 2026-01-29
Last updated on: 2026-04-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | inspektor_gadget | to 0.48.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection issue in the Inspektor Gadget tool's image building process. Specifically, the Makefile template used during image building includes user-controlled data without proper escaping. An attacker who can control certain build options in the YAML manifest used by the 'ig image build' command can execute arbitrary commands on the Linux host or build container during the image build. This can happen if untrusted gadget manifests are built, such as in CI/CD pipelines. The issue was fixed in version 0.48.1.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to execute arbitrary commands on the Linux host or build container where the image build is performed. This could lead to unauthorized access, data compromise, or disruption of the system running the 'ig' command. The attacker needs to control the build manifest or its options, which might be possible in environments that build untrusted gadgets, such as CI/CD pipelines.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Inspektor Gadget to version 0.48.1 or later, as this version fixes the command injection vulnerability in the image building process. Additionally, avoid building images from untrusted gadget manifests or controlling the build.yml file passed to the `ig image build` command, especially in CI/CD scenarios.