Executive Summary

CVE-2026-25996 is a vulnerability in the inspektor-gadget (ig) tool, specifically in its default interactive columns output mode. The issue occurs because string fields from eBPF events are rendered directly to the terminal without sanitizing control characters or ANSI escape sequences.

This lack of sanitization allows a maliciously crafted event payload, originating from an observed container, to inject ANSI escape sequences into the terminal of the ig operator. These escape sequences can manipulate the terminal display in various ways.

• Possible effects include log injection (inserting or deleting lines), denial of service (DoS), writing to the system clipboard, creating hyperlinks to attacker-controlled servers, changing the terminal window title, and potentially executing arbitrary code via Operating System Command (OSC) ANSI escape sequences.

A proof-of-concept demonstrated how a container could create files with embedded ANSI escape sequences that manipulate terminal output, such as overwriting log lines to hide sensitive file accesses.

The vulnerability was patched in version v0.49.1 by properly sanitizing ANSI escape sequences in the columns output mode.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to manipulate the terminal output of the inspektor-gadget tool when running in columns output mode.

• An attacker could inject escape sequences that alter or hide log entries, potentially concealing malicious activities.
• It could cause denial of service by disrupting the terminal display.
• It might allow writing to the system clipboard or creating clickable links to attacker-controlled servers, increasing the risk of further compromise.
• In some cases, it could enable execution of arbitrary code through Operating System Command (OSC) ANSI escape sequences.

Overall, this could undermine the reliability and security of system inspection and monitoring activities performed with inspektor-gadget.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing the output of the inspektor-gadget (ig) tool when running in its default interactive columns output mode, specifically when tracing eBPF events such as file open operations.

A practical detection method is to run the command `ig run trace_open` interactively and watch for suspicious or unexpected ANSI escape sequences or control characters in the terminal output, which may indicate maliciously forged event payloads.

For example, running a container that performs normal file operations and then creates a file with embedded ANSI escape sequences can demonstrate the vulnerability by manipulating the terminal output.

• Run `ig run trace_open` in interactive columns mode to monitor eBPF events.
• Look for unusual terminal behavior such as overwritten log lines, changed terminal titles, or unexpected hyperlinks.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade inspektor-gadget to version v0.49.1 or later, where the vulnerability has been patched by properly sanitizing ANSI escape sequences in the columns output mode.

This patch escapes output strings before printing to the terminal, preventing malicious escape sequences from being interpreted and thus protecting against terminal manipulation.

Until the upgrade can be applied, avoid running inspektor-gadget in the default interactive columns output mode or use the JSON output mode, which already sanitizes content and is not affected by this vulnerability.

Useful 0 Not Useful 0