-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation enabling path traversal. The patch PR #2964 explicitly mentions adding validation to the namespace flag, indicating it was a key vector. The namespace parameter was likely used unsanitized in file path construction (e.g., for manifest generation), allowing attackers to escape directories. The workaround's focus on isolated shells aligns with environment variable/CLI argument injection risks. While exact pre-patch code isn't available, the PR context and CWE-22 strongly implicate namespace handling as the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/fluxcd/flux2 | go | >= 0.21.0, < 0.32.0 | 0.32.0 |
KEV Misses 88% of Exploited CVEs- Get the report