GHSA-XV56-3WQ5-9997 Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

Summary The user-provided chart name in the kustomize manager is appended to the helm pull --untar command without proper sanitization. Details Adversaries can provide a maliciously crafted kustomization.yaml in conjunction with a Helm repo's index.yaml file to trick Renovate to execute arbitrary...

Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

Summary The user-provided chart name in the kustomize manager is appended to the helm pull --untar command without proper sanitization. Details Adversaries can provide a maliciously crafted kustomization.yaml in conjunction with a Helm repo's index.yaml file to trick Renovate to execute arbitrary...

EUVD-2026-2097

Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository...

CVE-2021-41254

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could...

[SECURITY] Fedora 42 Update: kustomize-5.8.0-1.fc42

Customization of kubernetes YAML configurations...

[SECURITY] Fedora 43 Update: kustomize-5.8.0-1.fc43

Customization of kubernetes YAML configurations...

Fedora: Security Advisory (FEDORA-2025-ecfd96d6a3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : kustomize (2025-ecfd96d6a3)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ecfd96d6a3 advisory. Update to 5.8.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Fedora 42 : kustomize (2025-a887e86abc)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a887e86abc advisory. Update to 5.8.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

CVE-2025-58183 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, flux, crane, wait-for-port, kube-vip-cloud-provider, grafana-pyroscope, kubernetes-dashboard-web-fips, rancher-security-scan-fips, kube-rbac-proxy, spire-controller-manager, ipfs-cluster-fips, knative-operator-fips, glow, rancher-webhook,...