CVE-2021-25743
ANSI escape characters in kubectl output are not being filtered
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ANSI escape characters in kubectl output are not being filtered
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
CVE-2021-25743- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-150
- Updated
- 2026-11-02
EUVDEUVD-2022-0579
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
EUVD-2022-0579- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9jg-8p32-2f55
kubectl ANSI escape characters not filtered
kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
GHSA-f9jg-8p32-2f55- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-150
- Updated
- 2026-11-02
NVD
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
CVE-2021-25743- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:N/I:P/A:N - Weakness
- CWE-150
- Updated
- 2026-11-02
OSV
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
CVE-2021-25743- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-25743
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
DEBIAN-CVE-2021-25743- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
Show 13 moreShow less
OSVGHSA-f9jg-8p32-2f55
kubectl ANSI escape characters not filtered
kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
GHSA-f9jg-8p32-2f55- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-150
- Updated
- 2026-11-02
OSVOESA-2022-2132
kubernetes security update
Container cluster management.
Security Fix(es):
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.(CVE-2021-25743)
- Record
OESA-2022-2132- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2023-1020
kubernetes security update
Container cluster management.
Security Fix(es):
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.(CVE-2021-25743)
- Record
OESA-2023-1020- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-25743
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Record
UBUNTU-CVE-2021-25743- CVSS 3.1
- 3.0 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGO-2022-0983 No score
ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
- Record
GO-2022-0983- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score
govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15424-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2858-1 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: Fixed sanitization of raw data of escape, meta or control sequences before output it to terminal (bsc#1194400)
- Record
SUSE-SU-2024:2858-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2859-1 No score
Security update for kubernetes1.24
This update for kubernetes1.24 fixes the following issues:
- CVE-2021-25743: Fixed sanitization of raw data of escape, meta or control sequences before output it to terminal (bsc#1194400)
- Record
SUSE-SU-2024:2859-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2928-1 No score
Security update for kubernetes1.25
This update for kubernetes1.25 fixes the following issues:
- CVE-2021-25743: Fixed sanitization of raw data of escape, meta or control sequences before output it to terminal (bsc#1194400)
Other fixes:
- Included kubernetes1.25-client package. (jsc#PED-5755)
- Record
SUSE-SU-2024:2928-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3341-1 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)
- CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
- CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)
- CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)
- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
- CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)
- CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)
- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)
Bug fixes:
- Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
- Fix multiple issues for successful
kubeadm initrun. (bsc#1214406) - Update go to version 1.22.5 in build requirements. (bsc#1229858)
- Record
SUSE-SU-2024:3341-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3343-1 No score
Security update for kubernetes1.24
This update for kubernetes1.24 fixes the following issues:
- CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)
- CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
- CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)
- CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)
- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
- CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)
- CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)
- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)
Bug fixes:
- Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
- Fix multiple issues for successful
kubeadm initrun. (bsc#1214406) - Update go to version 1.22.5 in build requirements. (bsc#1229858)
- Record
SUSE-SU-2024:3343-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02423-1 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
- Record
SUSE-SU-2025:02423-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02423-2 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
- Record
SUSE-SU-2025:02423-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
k8s.io/kubernetesGo |
before 1.26.0-alpha.3 | 1.26.0-alpha.3 |
kubernetesDebian:12 |
before 1.20.5+really1.20.2-1.1 | 1.20.5+really1.20.2-1.1 |
kubernetesDebian:13 |
before 1.31.4+ds-1 | 1.31.4+ds-1 |
kubernetesDebian:14 |
before 1.31.4+ds-1 | 1.31.4+ds-1 |
kubernetesopenEuler:20.03-LTS-SP1 |
before 1.20.2-15.oe1 | 1.20.2-15.oe1 |
kubernetesopenEuler:20.03-LTS-SP3 |
before 1.20.2-15.oe1 | 1.20.2-15.oe1 |
kubernetesopenEuler:22.03-LTS |
before 1.20.2-15.oe2203 | 1.20.2-15.oe2203 |
kubernetesopenEuler:22.03-LTS-SP1 |
before 1.20.2-16.oe2203sp1 | 1.20.2-16.oe2203sp1 |
kubernetes1.23SUSE:Linux Enterprise Module for Containers 15 SP5 |
before 1.23.17-150500.3.15.1 | 1.23.17-150500.3.15.1 |
kubernetes1.23openSUSE:Leap 15.5 |
before 1.23.17-150500.3.15.1 | 1.23.17-150500.3.15.1 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kubernetes1.23openSUSE:Leap 15.6 |
before 1.23.17-150500.3.15.1 | 1.23.17-150500.3.15.1 |
kubernetes1.24SUSE:Linux Enterprise Module for Containers 15 SP5 |
before 1.24.17-150500.3.19.1 | 1.24.17-150500.3.19.1 |
kubernetes1.24openSUSE:Leap 15.5 |
before 1.24.17-150500.3.19.1 | 1.24.17-150500.3.19.1 |
kubernetes1.24openSUSE:Leap 15.6 |
before 1.24.17-150500.3.19.1 | 1.24.17-150500.3.19.1 |
kubernetes1.25SUSE:Linux Enterprise Module for Containers 15 SP5 |
before 1.25.16-150400.9.10.1 | 1.25.16-150400.9.10.1 |
kubernetes1.25SUSE:Linux Enterprise Module for Containers 15 SP6 |
before 1.25.16-150400.9.10.1 | 1.25.16-150400.9.10.1 |
kubernetes1.25openSUSE:Leap 15.5 |
before 1.25.16-150400.9.10.1 | 1.25.16-150400.9.10.1 |
kubernetes1.25openSUSE:Leap 15.6 |
before 1.25.16-150400.9.10.1 | 1.25.16-150400.9.10.1 |
kubernetes1.24SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.24SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.24SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.24SUSE:Enterprise Storage 7.1 From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.23SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Enterprise Storage 7.1 From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 0.0.20250807T150727-1.1 | 0.0.20250807T150727-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-25743 is a low vulnerability (CVSS 3.0) in Kubernetes, published January 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in k8s.io/kubernetes 1.26.0-alpha.3.
References
github.com/kubernetes/kubernetes/issues/101695
security.netapp.com/advisory/ntap-20220217-0003
nvd.nist.gov/vuln/detail/CVE-2021-25743
Show 82 moreShow less
security-tracker.debian.org/tracker/CVE-2021-25743
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2132
suse.com/support/update/announcement/2024/suse-su-20242858-1
bugzilla.suse.com/1194400
ubuntu.com/security/CVE-2021-25743
cve.org/CVERecord?id=CVE-2021-25743