GHSA-RP7V-4384-HFRP高危已审查

k8sGPT has Prompt Injection through its k8sGPT-Operator

OSV 1.4.0 · github-reviewed · 修改于 2026-04-25 00:37

发布时间

2026-04-25 00:37

GitHub 审查时间

2026-04-25 00:37

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/04/GHSA-rp7v-4384-hfrp/GHSA-rp7v-4384-hfrp.json

公告说明

Summary

In the auto-remediation pipeline, object_to_execution.go was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.

Details

This issue was fixed after coordination with Alex Jones.

PoC

To minimize the impact, the PoC of this vulnerability wasn't released, but was shared with the maintainers.

受影响的软件包

github.com/k8sgpt-ai/k8sgpt

ECOSYSTEM

引入00.4.32

标识信息

别名 / CVE

无

CWE

CWE-20CWE-502CWE-915

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-rp7v-4384-hfrp",
  "aliases": [],
  "details": "### Summary\nIn the auto-remediation pipeline, `object_to_execution.go` was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.\n\n### Details\nThis issue was fixed after coordination with Alex Jones.\n\n### PoC\nTo minimize the impact, the PoC of this vulnerability wasn't released, but was shared with the maintainers.",
  "summary": "k8sGPT has Prompt Injection through its k8sGPT-Operator",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.32"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/k8sgpt-ai/k8sgpt",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-04-24T16:37:12Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-04-24T16:37:12Z",
  "references": [
    {
      "url": "https://github.com/k8sgpt-ai/k8sgpt/security/advisories/GHSA-rp7v-4384-hfrp",
      "type": "WEB"
    },
    {
      "url": "https://github.com/k8sgpt-ai/k8sgpt",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-502",
      "CWE-915"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-04-24T16:37:12Z"
  }
}