KubeAI, an AI inference operator for Kubernetes, has an OS command injection vulnerability (CWE-78) in versions before 0.23.2. The vulnerability arises because the ollamaStartupProbeScript() function uses fmt.Sprintf to build a shell command string incorporating unsanitized model URL components (ref, modelParam). This command is executed via 'bash -c' as a Kubernetes startup probe, allowing an attacker with Model custom resource modification privileges to execute arbitrary shell commands inside model server pods. The issue is resolved in version 0.23.2.

Successful exploitation allows an attacker with permissions to create or update Model custom resources to execute arbitrary shell commands within the context of model server pods. This can lead to complete compromise of the affected pod, including confidentiality and integrity impacts. The CVSS 3.1 score is 8.7 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality and integrity impact with no availability impact.

Upgrade KubeAI to version 0.23.2 or later, where this vulnerability is fixed. Since no official patch or temporary fix details are provided beyond the version update, applying this upgrade is the recommended remediation. Restrict permissions to create or update Model custom resources to trusted users only to reduce risk until the upgrade is applied.