CVE-2021-23154CWE-94

Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided

Medium · published January 10, 2022

CVSS v3.1
6.3
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00604 · 48.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-01-10T15:05Z
EPSS history
Timeline
  • 10 JAN 15:05Z
    Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided
    cvelistv5