CVE-2025-53542

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53542
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53542.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53542
Aliases
  • GHSA-34rf-485x-g5h7
Published
2025-07-10T18:20:21.446Z
Modified
2026-04-10T05:32:14.616215Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Kubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSign
Details

Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of Node.js's execSync() function with unsanitized input derived from environment variables, which can be influenced by an attacker. The variables ${teamID}, ${entitlementsPath}, and ${config.app} are dynamically derived from the environment or application config and passed directly to the shell command without proper escaping or argument separation. This exposes the system to command injection if any of the values contain malicious input. This vulnerability is fixed in 0.31.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53542.json",
    "cwe_ids": [
        "CWE-78",
        "CWE-88"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/kubernetes-sigs/headlamp

Affected ranges

Type
GIT
Repo
https://github.com/kubernetes-sigs/headlamp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
56d0e52041b5f0d0d7964b21c6e75e5e12dc62ce

Affected versions

headlamp-helm-0.*
headlamp-helm-0.1.0
headlamp-helm-0.1.1
headlamp-helm-0.1.2
headlamp-helm-0.1.3
headlamp-helm-0.1.4
headlamp-helm-0.1.5
headlamp-helm-0.10.0
headlamp-helm-0.11.0
headlamp-helm-0.12.0
headlamp-helm-0.13.0
headlamp-helm-0.14.0
headlamp-helm-0.15.0
headlamp-helm-0.16.0
headlamp-helm-0.17.1
headlamp-helm-0.18.0
headlamp-helm-0.18.1
headlamp-helm-0.18.2
headlamp-helm-0.19.0
headlamp-helm-0.2.0
headlamp-helm-0.20.0
headlamp-helm-0.21.0
headlamp-helm-0.22.0
headlamp-helm-0.23.0
headlamp-helm-0.24.0
headlamp-helm-0.25.0
headlamp-helm-0.26.0
headlamp-helm-0.27.0
headlamp-helm-0.28.0
headlamp-helm-0.28.1
headlamp-helm-0.29.1
headlamp-helm-0.3.0
headlamp-helm-0.30.1
headlamp-helm-0.31.0
headlamp-helm-0.4.0
headlamp-helm-0.5.0
headlamp-helm-0.6.0
headlamp-helm-0.7.0
headlamp-helm-0.8.0
headlamp-helm-0.9.0
headlamp-plugin-0.*
headlamp-plugin-0.11.0
headlamp-plugin-0.4.7
headlamp-plugin-0.4.9
headlamp-plugin-0.5.5
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.10.0
v0.10.1
v0.11.0
v0.12.0
v0.12.1
v0.13.0
v0.15.0
v0.17.0
v0.18.0
v0.2.0
v0.2.1
v0.20.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.3.0-beta
v0.3.0-beta1
v0.30.0
v0.31.0
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.7.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53542.json"