The advisory for Kiali 2.4.11 in Red Hat OpenShift Service Mesh 3.0 reports fixes for three CVEs: CVE-2025-64756, CVE-2025-66031, and CVE-2025-12816. CVE-2025-64756 is a command injection vulnerability in the glob CLI when using the -c/--cmd option with shell:true, allowing execution of arbitrary OS commands via malicious filenames. CVE-2025-66031 involves an unbounded recursion issue in the node-forge ASN.1 parser, which can lead to denial of service. The vulnerabilities affect the command line interface components used by Kiali but not the programmatic use of glob in npm. The advisory does not explicitly state a patch release beyond Kiali 2.4.11, which includes these fixes. The vulnerabilities require conditions such as processing malicious filenames or having permissions to create such files. Red Hat rates the severity as high and provides guidance to avoid using vulnerable CLI options with untrusted input.

Successful exploitation of CVE-2025-64756 could allow an attacker to execute arbitrary operating system commands with the privileges of the Kiali process by leveraging command injection via malicious filenames processed by the glob CLI. CVE-2025-66031 could cause denial of service through unbounded recursion in ASN.1 parsing. These impacts include unauthorized code execution, potential data modification or disclosure, and service disruption. However, exploitation requires specific conditions such as the use of the vulnerable CLI with crafted filenames and appropriate permissions. There are no known exploits in the wild at this time.

Red Hat advises avoiding use of the glob CLI with the -c/--cmd option on untrusted filenames to mitigate the command injection vulnerability. Filenames should be sanitized before being passed to commands executed with shell interpretation enabled. Kiali 2.4.11 includes the fixes for these vulnerabilities. Users should upgrade to this version and follow the official Red Hat OpenShift Service Mesh 3.0 documentation for deployment and update instructions. Since this is not a cloud service, remediation is managed by the user applying the updated Kiali version. Monitor Red Hat advisories for any further updates or patches.