PT-2026-37207 · Go · Github.Com/K8Sgpt-Ai/K8Sgpt

Published 2026-04-24 · Updated 2026-04-24

OSV

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

In the auto-remediation pipeline, object to execution.go was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.

Details

This issue was fixed after coordination with Alex Jones.

PoC

To minimize the impact, the PoC of this vulnerability wasn't released, but was shared with the maintainers.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-915

CWE-20

Related Identifiers

GHSA-RP7V-4384-HFRP

Affected Products

Github.Com/K8Sgpt-Ai/K8Sgpt

References · 3

• https://osv.dev/vulnerability/GHSA-rp7v-4384-hfrp · Vendor Advisory
• https://github.com/k8sgpt-ai/k8sgpt/security/advisories/GHSA-rp7v-4384-hfrp · Note
• https://github.com/k8sgpt-ai/k8sgpt · Note