Command Injection Vulnerability in Inspektor Gadget by Lin-bit

CVE-2026-24905

What is CVE-2026-24905?

Inspektor Gadget, a toolset for data collection and system inspection on Kubernetes and Linux, has a command injection vulnerability that allows attackers to execute arbitrary commands. This flaw arises from unsafe handling of user input in the image building process, particularly regarding the parameters in the 'buildOptions' structure. Before version 0.48.1, an attacker could control the 'build.yml' file passed to 'ig image build' or its parameters, leading to execution of unauthorized commands on the Linux host or build container. Users must update to the fixed version to mitigate this security risk.

References