Read the docs
TI-2026-21010 Aliases CVE-2026-25996GHSA-34r5-6j7w-235f

Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

Priority HIGH 70CWE-150Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00636 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed inspektor-gadget (inspektor-gadget): 0.49.1github.com/inspektor-gadget/inspektor-gadget (Go): 0.49.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageinspektor-gadgetbefore 0.49.10.49.1Patch availableCNA
—github.com/inspektor-gadget/inspektor-gadget (Go)before 0.49.10.49.1Patch availableGHSA-34r5-6j7w-235f
  • inspektor-gadget Vendorbackstage Affected before 0.49.1 Fixed in 0.49.1 Patch available CNA
  • github.com/inspektor-gadget/inspektor-gadget (Go) Vendor— Affected before 0.49.1 Fixed in 0.49.1 Patch available GHSA-34r5-6j7w-235f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:inspektor_gadget:*:*:*:*:*:*:*:*before 0.49.1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:inspektor_gadget:*:*:*:*:*:*:*:* Versions before 0.49.1 Vulnerable ·backstage

Remediation

  • Fix · CNA inspektor-gadget (inspektor-gadget) Fixed in 0.49.1
  • Fix · GHSA-34r5-6j7w-235f github.com/inspektor-gadget/inspektor-gadget (Go) Fixed in 0.49.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25996
  2. 2026-10-03 Alias added: GHSA-34r5-6j7w-235f

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-24442 Inspektor Gadget: Tracing Denial of Service via Event Flooding CVSS 4.0MEDIUM 4.8
  • TI-2026-20090 Inspektor Gadget has a Command Injection vulnerability in Makefile.build CVSS 4.0MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences