title: ANSI escape characters in kubectl output are not being filtered
description: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
problem types: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
lessThanOrEqual: 1.23.1, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unknown, version: next of 1.23.1, versionType: custom
lessThanOrEqual: 1.22.5, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unknown, version: next of 1.22.5, versionType: custom
lessThanOrEqual: 1.21.8, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unknown, version: next of 1.21.8, versionType: custom
lessThanOrEqual: 1.20.14, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unknown, version: next of 1.20.14, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
]