CVE-2021-25743

LOW

kubernetes < 1.25.0 and >= 1.26.0-alpha.3 - Terminal Escape Sequence Injection via kubectl Output

Title source: llm
STIX 2.1

Description

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220217-0003/

Scores

CVSS v3 3.0
EPSS 0.0078
EPSS Percentile 52.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Details

CWE
CWE-150
Status published
Products (3)
k8s.io/kubernetes 0 - 1.26.0-alpha.3Go
kubernetes/kubernetes 1.26.0 alpha0 (3 CPE variants)
kubernetes/kubernetes < 1.25.0
Published Jan 07, 2022
Tracked Since Feb 18, 2026