Approved changes feed: RSS · Atom
cpe:2.3:a:kubernetes-sigs:headlamp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kubernetes Sigs (2fa07acf-f5a9-5ef0-9ddd-1505e538398e) |
|---|---|
| Product | Headlamp (0f912ee4-88e7-5bb4-9204-beddc896b0c3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-53542 |
vulnerable | 2026-06-08 07:31:14.695145 |
Kubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSign
HIGH (7.8)
Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of Node.js's execSync() function with unsanitized input derived from environment variables, which can be influenced by an attacker. The variables ${teamID}, ${entitlementsPath}, and ${config.app} are dynamically derived from the environment or application config and passed directly to the shell command without proper escaping or argument separation. This exposes the system to command injection if any of the values contain malicious input. This vulnerability is fixed in 0.31.1.
Published: 2025-07-10T18:20:21.446Z
Updated: 2025-07-10T19:03:00.522Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.