CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2024-10220
High (8.1). EPSS 3.0% chance of exploitation in the next 30 days. Fixed in k8s.io/kubernetes 1.28.12, 1.29.7, 1.30.3.
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
Severity
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-27wf-5967-98gx | Go | k8s.io/kubernetes | <1.28.12 | 1.28.12 |
| GHSA-27wf-5967-98gx | Go | k8s.io/kubernetes | >=1.29.0 <1.29.7 | 1.29.7 |
| GHSA-27wf-5967-98gx | Go | k8s.io/kubernetes | >=1.30.0 <1.30.3 | 1.30.3 |
| GO-2024-3286 | Go | k8s.io/kubernetes | <1.28.12 >=1.29.0 <1.29.7 >=1.30.0 <1.30.3 | 1.28.12, 1.29.7, 1.30.3 |