Description
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloud Native Computing Foundation (CNCF) | Fluentd | 0.12.29 through 0.12.40 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-optools 13 | fluentd | 0.12.41-1.el7 | RHSA-2018:2225 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | fluentd | >= 0.12.29, < 0.12.41 | 0.12.41 | GHSA-5jrp-w8fr-mrww |
Advisories 1
- RHSA-2018:2225 Red Hat Security Advisory: fluentd security update Red Hat Security Advisories (RHSA) · May 13, 2026