CVE-2026-25996: Inspektor Gadget XSS Vulnerability

CVE-2026-25996 Overview

CVE-2026-25996 is a Missing Input Sanitization vulnerability in Inspektor Gadget, a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. A maliciously forged event payload from an observed container can inject escape sequences into the terminal of Inspektor Gadget operators, potentially causing various adverse effects.

Critical Impact

Attackers controlling observed containers can inject malicious ANSI escape sequences into operator terminals, potentially enabling terminal manipulation, misleading output, or exploitation of terminal emulator vulnerabilities.

Affected Products

• Inspektor Gadget versions prior to v0.49.1

Discovery Timeline

• 2026-02-12 - CVE CVE-2026-25996 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-25996

Vulnerability Analysis

This vulnerability stems from improper handling of user-controlled input that flows through eBPF event processing. When Inspektor Gadget runs in its default interactive mode with columns output, string fields from eBPF events are written directly to the terminal without filtering control characters or ANSI escape sequences. This creates a terminal injection attack surface where malicious containers can craft event payloads containing escape sequences that affect the operator's terminal session.

The weakness is classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences), which describes scenarios where applications fail to properly sanitize special characters that have meaning in the output context.

Root Cause

The root cause is the lack of input sanitization in the columns output rendering pipeline. When eBPF events are collected from observed containers and displayed to operators, the string fields are passed through without filtering potentially dangerous control characters or ANSI escape codes. Since the columns output mode is the default for interactive ig run sessions, this creates a default-unsafe configuration.

Attack Vector

The attack vector is network-based, requiring an attacker to have control over a container being observed by Inspektor Gadget. The attacker crafts malicious payloads containing ANSI escape sequences within string fields that will be captured by eBPF probes. When these events are rendered in the operator's terminal, the escape sequences are interpreted, allowing the attacker to:

• Manipulate terminal display output to hide or spoof information
• Inject misleading data into the operator's view
• Potentially exploit vulnerabilities in terminal emulators
• Modify terminal settings or execute terminal-specific commands

The attack does not require user interaction beyond running Inspektor Gadget in its default configuration, making it particularly concerning for Kubernetes security operators who rely on the tool for cluster inspection.

Detection Methods for CVE-2026-25996

Indicators of Compromise

• Unexpected terminal behavior or visual artifacts when running ig run commands
• Container logs or process names containing unusual character sequences (hex values like \\x1b[ or \033[)
• Terminal settings unexpectedly changed after running Inspektor Gadget sessions
• Anomalous container activity generating events with suspicious string patterns

Detection Strategies

• Monitor for containers generating events with embedded escape sequences in string fields
• Implement logging of raw eBPF event data before terminal rendering to detect injection attempts
• Deploy SentinelOne Singularity for Kubernetes to detect anomalous container behavior and potential injection attacks
• Review container images and runtime behavior for intentional escape sequence generation

Monitoring Recommendations

• Enable audit logging for Inspektor Gadget sessions to capture raw event data
• Configure alerting for containers exhibiting unusual output patterns in monitored events
• Implement network segmentation to limit which containers can be observed by Inspektor Gadget
• Use SentinelOne's runtime protection to monitor for suspicious container activities that may indicate exploitation attempts

How to Mitigate CVE-2026-25996

Immediate Actions Required

• Upgrade Inspektor Gadget to version v0.49.1 or later immediately
• Avoid running ig run in interactive columns output mode with untrusted containers until patched
• Use non-interactive output modes (JSON, YAML) when observing untrusted workloads as a temporary workaround
• Review recent Inspektor Gadget sessions for signs of terminal manipulation

Patch Information

The vulnerability has been addressed in Inspektor Gadget version v0.49.1. The fix implements proper sanitization of control characters and ANSI escape sequences in string fields before terminal rendering. Organizations should update to this version or later to remediate the vulnerability.

For detailed information about the fix, refer to the GitHub Commit Changes and the GitHub Security Advisory GHSA-34r5-6j7w.

Workarounds

• Use JSON or YAML output modes instead of the default columns mode when observing containers: ig run --output json
• Pipe output through sanitization tools that strip control characters before terminal display
• Run Inspektor Gadget in non-interactive mode and review output in a controlled environment
• Limit observation scope to trusted containers and namespaces until the patch is applied

# Use JSON output mode to avoid terminal escape sequence interpretation
ig run trace_exec --output json

# Alternative: Use YAML output for structured, sanitized data
ig run trace_exec --output yaml

# Pipe output through a control character filter if interactive mode is required
ig run trace_exec | cat -v