This advisory covers security fixes in Kiali 1.73.25 for Red Hat OpenShift Service Mesh 2.6. Key vulnerabilities include CVE-2025-64756, a command injection flaw in the glob CLI when used with the -c/--cmd option, allowing arbitrary command execution via shell metacharacters in malicious filenames. Another is CVE-2025-66031, an unbounded recursion issue in node-forge ASN.1 parsing. Exploitation requires the ability to create or trick the system into processing malicious files with glob CLI. The glob CLI is not used by npm, reducing exposure. Red Hat provides fixed images and documentation for remediation.

Successful exploitation of CVE-2025-64756 could lead to arbitrary command execution with the privileges of the user running the glob CLI, potentially allowing attackers to disable services, read or modify data, or hide malicious activities. The unbounded recursion in node-forge ASN.1 (CVE-2025-66031) could cause denial of service via resource exhaustion. These vulnerabilities impact confidentiality, integrity, and availability of affected systems. No known exploits in the wild have been reported.

Red Hat has released Kiali 1.73.25 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. Specifically, avoid using the glob CLI with the -c/--cmd option on untrusted filenames. If programmatic use of glob is necessary, sanitize filenames thoroughly before passing them to shell commands. Follow Red Hat's official documentation and advisories for applying updates and patches.