CLEANSTART-2026-FB10821: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal
Security vulnerability affects the nfs-subdir-external-provisioner package. kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/nfs-subdir-external-provisionerto a version that resolves this vulnerability.Fixed in 4.0.2-r4
Event History
Frequently Asked Questions
Who is most likely to be exposed?
Operators using kubectl to display raw Kubernetes data in a terminal are exposed when that data can contain attacker-controlled escape, meta, or control sequences. The affected software identified is cleanstart/nfs-subdir-external-provisioner.
What does an attacker need to exploit this issue?
Exploitation requires network access, low privileges, high attack complexity, and user interaction. A user must view the crafted raw data through kubectl in a terminal.