A command injection vulnerability exists in the inspektor-gadget 'ig' binary's image building subcommand due to unsafe inclusion of user-controlled build options in Makefile commands without proper escaping. This allows an attacker who can control the buildOptions structure (via the gadget manifest YAML) to execute arbitrary commands during the image build process. The impact includes arbitrary command execution on the Linux host if the build is local, or inside the build container if not local. The vulnerability affects versions prior to 0.51.1 and has been assigned CVE-2026-24905 with a high severity rating.