PT-2025-29128 · Headlamp · Headlamp

Odaysec · Published 2025-07-10 · Updated 2025-07-15 · CVE-2025-53542

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Headlamp versions prior to 0.31.1

Description: Headlamp is an extensible Kubernetes web UI. A command injection issue exists in the codeSign.js script used during the macOS packaging workflow. This is due to the improper use of the execSync() function with unsanitized input from environment variables. The variables ${teamID}, ${entitlementsPath}, and ${config.app} are dynamically derived and passed to shell commands without proper escaping or argument separation, potentially allowing command injection if these values contain malicious input.

Recommendations: Update to Headlamp version 0.31.1 or later.

Exploit

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

BDU:2026-00283

CVE-2025-53542

GHSA-34RF-485X-G5H7

Affected Products

Headlamp

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53542.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53542 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53542 · Security Note
• https://github.com/kubernetes-sigs/headlamp/security/advisories/GHSA-34rf-485x-g5h7 · Note
• https://github.com/kubernetes-sigs/headlamp/pull/3377 · Note
• https://github.com/kubernetes-sigs/headlamp/commit/5bc0a9dd87acdf1e04be14619acde687eefa35fb · Note
• https://advisory.zerodaysec.org/advisory/kubernetes-headlamp-code-signing · Note
• https://twitter.com/VulmonFeeds/status/1943474265702941142 · Twitter Post
• https://twitter.com/CVEnew/status/1943700226381943242 · Twitter Post
• https://twitter.com/cracbot/status/1945075956693045576 · Twitter Post