CVE-2021-23154 MEDIUM

CVE-2021-23154: Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided

Vendor Mirantis
Product Lens
Weakness CWE-94 · Code injection
Published January 10, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system.

Key dates

02Disclosure timeline

January 10, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-56264 Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint CVE-2026-49493 Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS() CVE-2026-41523 vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution CVE-2026-33646 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) CVE-2026-7873 Code Injection Vulnerability in Code Validation Endpoint