{"id":"CVE-2024-10220","aliases":["GHSA-27wf-5967-98gx","GO-2024-3286"],"url":"https://o3.security/vulnerability/CVE-2024-10220","summary":"Arbitrary command execution through gitRepo volume","details":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","published":"2024-11-22T16:23:00.535Z","modified":"2026-08-12T03:51:23.161563167Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.28.12"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.29.7"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.30.3"}],"fix":{"url":"https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b","label":"kubernetes/kubernetes@1ab06ef"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/11/20/1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10220.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10220"},{"type":"REPORT","url":"https://github.com/kubernetes/kubernetes/issues/128885"},{"type":"PACKAGE","url":"https://github.com/kubernetes/kubernetes"},{"type":"ARTICLE","url":"https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko"},{"type":"WEB","url":"https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-3286"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.161563167Z"}}