inspektor-gadget Inspektor Gadget up to 0.49.0 Control Character Handler/ANSI Escape Sequence control sequence

Summaryinfo

A vulnerability has been found in inspektor-gadget Inspektor Gadget up to 0.49.0 and classified as problematic. The impacted element is an unknown function of the component Control Character Handler/ANSI Escape Sequence Handler. The manipulation leads to control sequence. This vulnerability is listed as CVE-2026-25996. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in inspektor-gadget Inspektor Gadget up to 0.49.0 and classified as problematic. This issue affects an unknown part of the component Control Character Handler/ANSI Escape Sequence Handler. The manipulation with an unknown input leads to a control sequence vulnerability. Using CWE to declare the problem leads to CWE-150. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. Impacted is integrity. The summary by CVE is:

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-25996 since 02/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.49.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• inspektor-gadget

Name

• Inspektor Gadget

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion