Description
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/karmada-io/karmada | <= 1.9.0 | — | GHSA-wccg-v638-j9q2 |
| Go | github.com/karmada-io/karmada | all versions | — | GO-2024-2817 |