GO-2025-3981
NoneCVSS
—
EPSS
—
Published
Oct 23, 2025
CISA due date
—
The record
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/gardener/gardener-extension-provider-aws | 0 | 1.64.0 |
| Go | github.com/gardener/gardener-extension-provider-azure | 0 | 1.55.0 |
| Go | github.com/gardener/gardener-extension-provider-gcp | 0 | 1.46.0 |
| Go | github.com/gardener/gardener-extension-provider-openstack | 0 | 1.49.0 |