CVE-2026-24905

Name of the Vulnerable Software and Affected Versions Inspektor Gadget versions prior to 0.48.1

Description Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The ig binary includes a subcommand for image building, which utilizes a Makefile.build file. This file incorporates user-controlled data without proper escaping, leading to a command injection issue. An attacker controlling values within the buildOptions structure can execute arbitrary commands during the image building process. Exploitation could occur on the Linux host where the ig command is executed, particularly when using the --local flag, or within the build container if the flag is not used. The buildOptions structure is derived from the YAML gadget manifest provided to the ig image build command, requiring control over the build.yml file or its options to exploit the issue.

Recommendations Update to version 0.48.1 or later.