CVE-2026-25996

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25996", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:41:55.859Z", "datePublished": "2026-02-12T20:06:58.709Z", "dateUpdated": "2026-02-12T20:57:00.522Z"}, "containers": {"cna": {"title": "Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-150", "lang": "en", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f"}, {"name": "https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2", "tags": ["x_refsource_MISC"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2"}, {"name": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1"}], "affected": [{"vendor": "inspektor-gadget", "product": "inspektor-gadget", "versions": [{"version": "< 0.49.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T20:06:58.709Z"}, "descriptions": [{"lang": "en", "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged \u2013 partially or completely \u2013 event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively."}], "source": {"advisory": "GHSA-34r5-6j7w-235f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T20:56:29.089471Z", "id": "CVE-2026-25996", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:57:00.522Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25996", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T20:56:29.089471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:56:45.784Z"}}], "cna": {"title": "Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode", "source": {"advisory": "GHSA-34r5-6j7w-235f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "inspektor-gadget", "product": "inspektor-gadget", "versions": [{"status": "affected", "version": "< 0.49.1"}]}], "references": [{"url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f", "name": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2", "name": "https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1", "name": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged \u2013 partially or completely \u2013 event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T20:06:58.709Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25996", "state": "PUBLISHED", "dateUpdated": "2026-02-12T20:57:00.522Z", "dateReserved": "2026-02-09T17:41:55.859Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-12T20:06:58.709Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "inspektor-gadget", "vendor": "inspektor-gadget", "versions": [{"status": "affected", "version": "< 0.49.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:inspektor_gadget:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC39D2AC-694C-4CD7-B0F4-B985092E1D3B", "versionEndExcluding": "0.49.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged \u2013 partially or completely \u2013 event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively."}, {"lang": "es", "value": "Inspektor Gadget es un conjunto de herramientas y framework para la recopilaci\u00f3n de datos y la inspecci\u00f3n del sistema en cl\u00fasteres de Kubernetes y hosts Linux utilizando eBPF. Los campos de cadena de los eventos eBPF en modo de salida de columnas se renderizan en la terminal sin ninguna sanitizaci\u00f3n de caracteres de control o secuencias de escape ANSI. Por lo tanto, una carga \u00fatil de evento forjada maliciosamente \u2013 parcial o completamente \u2013, proveniente de un contenedor observado, podr\u00eda inyectar las secuencias de escape en la terminal de los operadores de ig, con diversos efectos. El modo de salida de columnas es el predeterminado al ejecutar ig run de forma interactiva."}], "id": "CVE-2026-25996", "lastModified": "2026-06-17T10:25:33.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25996", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T20:56:29.089471Z", "version": "2.0.3"}}]}, "published": "2026-02-12T21:16:02.820", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-150"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.49.1)"}}], "product": "inspektor-gadget", "vendor": "inspektor-gadget"}], "analysis": {"en": {"generated_at": "2026-04-18T12:32:35.681296+00:00", "value": {"mitigation_remediation": ["Upgrade Inspektor Gadget to version 0.49.1 or later, where ANSI escape sequences are sanitized in columns mode. ", "Switch to a non-interactive output format or redirect output to a logfile when an upgrade is not immediately possible, to prevent terminal injection. ", "Enforce stricter container isolation so that only trusted workloads are allowed to generate eBPF events, reducing the likelihood of malicious event injection."], "summary": {"action": "Apply Patch", "impact": "Terminal Escape Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to the Inspektor Gadget toolset from the Linux Foundation. All releases prior to version 0.49.1 lack the sanitization fix. The advisory and release notes indicate that 0.49.1 and later incorporate the necessary corrections, so any installation using an older version is considered vulnerable.", "description_and_impact": "Inspektor Gadget outputs eBPF event strings in columns mode without sanitizing ANSI escape characters, allowing a malicious payload to embed terminal control codes. Such injection can change the appearance of the terminal, hide or distort operator data, and potentially mislead or confuse users during interactive sessions. The flaw is a moderate severity issue tied to CWE-150, which deals with manipulating control characters.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a moderate risk, while the EPSS score of less than 1% points to a very low probability of exploitation at present. The issue does not appear in the CISA KEV catalog, suggesting no known widespread attacks. Based on the description, the likely attack vector is an untrusted or compromised container that can inject forged eBPF events containing malicious ANSI sequences into the monitoring pipeline. The impact is confined to terminal manipulation and does not grant system compromise or data exfiltration, but it can undermine situational awareness for operators."}}}}, "created": "2026-02-13T21:29:26.741662+00:00", "updated": "2026-04-18T12:45:45.661856+00:00", "vendors": ["inspektor-gadget", "inspektor-gadget$PRODUCT$inspektor-gadget"]}