Detections
Analytics

SCA: security update for github.com/inspektor-gadget/inspektor-gadget (GHSA-79qw-g77v-2vfh)

high Tenable Self-Hosted Container Security Plugin ID 440738

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes
 clusters and Linux hosts using eBPF. The `ig` binary provides a subcommand for image building, used to
 generate custom gadget OCI images. A part of this functionality is implemented in the file `inspektor-
 gadget/cmd/common/image/build.go`. The `Makefile.build` file is the Makefile template employed during the
 building process. This file includes user-controlled data in an unsafe fashion, specifically some
 parameters are embedded without an adequate escaping in the commands inside the Makefile. Prior to version
 0.48.1, this implementation is vulnerable to command injection: an attacker able to control values in the
 `buildOptions` structure would be able to execute arbitrary commands during the building process. An
 attacker able to exploit this vulnerability would be able to execute arbitrary command on the Linux host
 where the `ig` command is launched, if images are built with the `--local` flag or on the build container
 invoked by `ig`, if the `--local` flag is not provided. The `buildOptions` structure is extracted from the
 YAML gadget manifest passed to the `ig image build` command. Therefore, the attacker would need a way to
 control either the full `build.yml` file passed to the `ig image build` command, or one of its options.
 Typically, this could happen in a CI/CD scenario that builds untrusted gadgets to verify correctness.
 Version 0.51.1 fixes the issue. (CVE-2026-24905)

Solution

Update the github.com/inspektor-gadget/inspektor-gadget library and its related packages to version 0.51.1 or later.

See Also

https://github.com/advisories/GHSA-79qw-g77v-2vfh

Plugin Details

Severity: High

ID: 440738

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 4/22/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-24905

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.5

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/22/2026

Vulnerability Publication Date: 1/29/2026

Reference Information

CVE: CVE-2026-24905