This advisory covers security fixes in Kiali 2.11.5 for Red Hat OpenShift Service Mesh 3.1. The main issues are: (1) a command injection vulnerability (CVE-2025-64756) in the glob command-line interface when using the -c/--cmd option, which executes shell commands with shell:true and does not sanitize filenames, allowing attackers with file creation permissions to execute arbitrary commands; (2) an unbounded recursion vulnerability in node-forge ASN.1 parsing (CVE-2025-66031) that could lead to denial of service or other impacts. The glob CLI vulnerability is mitigated by avoiding use of the -c/--cmd option on untrusted filenames or sanitizing inputs. The advisory does not provide a CVSS score but rates the impact as high. The vulnerabilities are fixed in Kiali 2.11.5, and users are advised to upgrade accordingly.

The command injection vulnerability (CVE-2025-64756) allows an attacker with the ability to create or influence filenames processed by the glob CLI with the -c/--cmd option to execute arbitrary OS commands with the privileges of the application. This can lead to unauthorized code execution, data modification, or denial of service. The node-forge ASN.1 unbounded recursion vulnerability (CVE-2025-66031) may cause application crashes or denial of service. Overall, these vulnerabilities pose a high security risk if exploited.

Red Hat has released Kiali 2.11.5 which includes fixes for these vulnerabilities. Users should upgrade to Kiali 2.11.5 for Red Hat OpenShift Service Mesh 3.1 to remediate these issues. Additionally, avoid using the glob CLI with the -c/--cmd option on untrusted filenames or ensure filenames are sanitized before processing. Follow the official Red Hat documentation for upgrade instructions and further guidance.