CVE-2026-25996: Inspektor Gadget XSS Vulnerability

CVE-2026-25996 Overview

CVE-2026-25996 affects Inspektor Gadget, a Linux Foundation toolkit for data collection and system inspection on Kubernetes clusters and Linux hosts using extended Berkeley Packet Filter (eBPF). The ig command-line tool renders string fields from eBPF events in columns output mode without sanitizing control characters or ANSI escape sequences. A malicious or compromised container can forge event payloads containing terminal escape sequences. When an operator observes these events interactively, the sequences are injected directly into the operator's terminal. The columns output mode is the default for ig run, exposing most interactive users to this attack surface.

Critical Impact

An observed container can manipulate the terminal of an ig operator through forged eBPF event strings, enabling output spoofing, screen manipulation, or command-line confusion.

Affected Products

• Linux Foundation Inspektor Gadget (versions prior to v0.49.1)
• ig command-line tool running in interactive columns output mode
• Deployments observing untrusted containerized workloads

Discovery Timeline

• 2026-02-12 - CVE-2026-25996 published to the National Vulnerability Database (NVD)
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-25996

Vulnerability Analysis

The vulnerability is classified as [CWE-150] Improper Neutralization of Escape, Meta, or Control Sequences. Inspektor Gadget collects events from eBPF programs attached to kernel hooks. These events include string fields that may originate from process arguments, file paths, or other data influenced by container workloads. In columns output mode, the renderer writes these strings directly to the operator's terminal without filtering bytes such as \\x1b (ESC), carriage returns, or backspace characters.

When a container produces strings containing ANSI escape sequences, the terminal interprets them as control commands. Adversaries can clear the screen, rewrite previously displayed log lines, change colors to disguise malicious output, move the cursor, or in some terminal emulators trigger window title changes and clipboard operations. The attack does not require authentication on the Inspektor Gadget side because the input arrives through normal observed activity.

Root Cause

The output formatter in the columns renderer treats event string fields as safe display data. No allow-list filtering or escape-sequence stripping is applied before writing to standard output. Any byte produced by an observed workload reaches the terminal verbatim.

Attack Vector

An attacker who controls a process inside an observed container crafts arguments, filenames, or other strings containing ANSI escape sequences. When the operator runs ig run interactively against that container, the eBPF probe captures the string and emits an event. The default columns renderer prints the raw bytes, and the operator's terminal executes the embedded sequences. The vulnerability is described in the GitHub Security Advisory GHSA-34r5-6j7w-235f.

Detection Methods for CVE-2026-25996

Indicators of Compromise

• Presence of \\x1b[ (ESC [) byte sequences in process arguments, file names, or other observable strings inside containers
• Unexpected terminal behavior during ig run sessions, including screen clears, color changes, or rewritten output lines
• Container workloads invoking processes with non-printable bytes in argv that have no legitimate functional purpose

Detection Strategies

• Audit container images and runtime processes for binaries or scripts that emit ANSI escape sequences into observable fields
• Capture ig session output to log files and scan for control-character byte patterns indicative of injection attempts
• Pipe ig output through a sanitizing tool such as cat -v or sed filters when investigating suspicious workloads

Monitoring Recommendations

• Track the installed Inspektor Gadget version across clusters and flag any host running a release earlier than v0.49.1
• Alert on ig invocations against untrusted or externally controlled namespaces while older versions remain deployed
• Record terminal sessions of operators running Inspektor Gadget so post-incident review can identify escape-sequence injection

How to Mitigate CVE-2026-25996

Immediate Actions Required

• Upgrade Inspektor Gadget to v0.49.1 or later on all hosts and Kubernetes clusters where ig is used
• Restrict interactive ig run usage against untrusted containers until the upgrade is complete
• Review the fix in commit d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2 to confirm the sanitization behavior meets operational requirements

Patch Information

The vendor released a fix in Inspektor Gadget v0.49.1. The patch sanitizes control characters and ANSI escape sequences from string fields before they are written by the columns renderer. Operators should update both the client-side ig binary and any deployed gadget components to ensure consistent sanitization.

Workarounds

• Switch from the default columns output mode to a structured format such as json and process events with a tool that does not interpret escape sequences
• Redirect ig output to a file and review it with a viewer that displays control characters literally rather than executing them
• Limit the use of Inspektor Gadget to trusted workloads until the upgrade to v0.49.1 is rolled out across the fleet

# Configuration example: use JSON output instead of the vulnerable columns mode
ig run trace_exec --output json | jq .