{"id":"CVE-2025-69902","aliases":["EUVD-2025-208773","GHSA-q2w8-w8pj-c9wh"],"status":"published","title":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2...","description":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.02387,"percentile":0.84157,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-03-16T00:00:00Z","modified":"2026-06-17T10:00:55Z","references":[{"url":"https://github.com/rohitg00/kubectl-mcp-server"},{"url":"https://pypi.org/project/kubectl-mcp-tool"},{"url":"https://github.com/rohitg00/kubectl-mcp-server/blob/main/kubectl_mcp_tool/minimal_wrapper.py"},{"url":"https://asec.ahnlab.com/ko/92922/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69902"},{"url":"https://asec.ahnlab.com/ko/92922"},{"url":"https://github.com/advisories/GHSA-q2w8-w8pj-c9wh"}],"sources":{"cve":[{"id":"CVE-2025-69902","description":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","status":"published","published":"2026-03-16T00:00:00Z","modified":"2026-03-17T14:01:39.958Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-208773","description":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","status":"published","published":"2026-03-16T00:00:00Z","modified":"2026-03-17T14:01:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:33.692584Z"}],"ghsa":[{"id":"GHSA-q2w8-w8pj-c9wh","title":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2...","description":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","status":"published","published":"2026-03-16T21:34:32Z","modified":"2026-03-17T15:36:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:06:40.510126Z"}],"nvd":[{"id":"CVE-2025-69902","description":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","status":"published","published":"2026-03-16T21:16:17.7Z","modified":"2026-06-17T10:00:55.29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:01.641503Z"}]}}