The Red Hat OpenShift Pipelines Operator 1.19.4 release addresses several security flaws including CVE-2025-6545, which is a command injection vulnerability in the glob command-line interface used by the operator. This vulnerability arises because the glob CLI executes shell commands using the -c/--cmd option without sanitizing filenames containing shell metacharacters, allowing attackers to execute arbitrary OS commands if they can supply malicious filenames. Exploitation requires the attacker to create or trick the system into processing such filenames with the glob CLI. The vulnerability is tracked under CWEs 20 (Improper Input Validation) and 78 (OS Command Injection). Red Hat has fixed these issues in the 1.19.4 release of OpenShift Pipelines Operator. The vendor advisory confirms the availability of this official fix and provides detailed issue tracking references.

Successful exploitation of the command injection vulnerability could allow an attacker to execute arbitrary operating system commands with the privileges of the OpenShift Pipelines Operator process. This could lead to unauthorized code execution, data modification, denial of service, or other malicious activities appearing to originate from the operator. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, exploitation requires the ability to create or influence filenames processed by the glob CLI with the -c/--cmd option, which limits the attack surface. No known exploits in the wild have been reported.

An official fix is available in Red Hat OpenShift Pipelines Operator version 1.19.4. Users should upgrade affected versions (>=1.19.0 <1.19.4) to 1.19.4 or later to remediate these vulnerabilities. Additionally, avoid using the glob CLI with the -c/--cmd option on untrusted filenames. If programmatic use of glob is necessary, ensure thorough sanitization of filenames before passing them to shell commands. Follow Red Hat's advisory and product documentation for upgrade instructions and further guidance.