The vulnerability resides in the Makefile.build template that the `ig image build` command uses to construct eBPF‑based gadget images. The template embeds build parameters directly into shell commands without proper escaping. An attacker who can influence the buildOptions structure (for example by supplying a malicious gadget manifest in a CI/CD pipeline) can inject shell commands that are executed during image creation. Depending on whether the `--local` flag is used, this execution may happen on the host where the `ig` command runs or inside the build container, giving the attacker command‑execution rights at the same privilege level as the `ig` process.

Inspektor Gadget v0.48.1 and earlier. The product is distributed by Linux Foundation under the vendor product mapping inspektor‑gadget:inspektor‑gadget. All versions below 0.48.1 that employ the compromised Makefile.build template are vulnerable.

The CVSS score of 6.6 indicates a medium severity. The EPSS score of less than 1 % suggests a low probability of exploitation in the wild at the time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalogue. The attack requires the attacker to control the buildOptions structure in the YAML gadget manifest or supply a malicious build.yml file, typically achievable in CI/CD pipelines building untrusted gadgets. If access is obtained, arbitrary commands can be executed with the same privileges as the ig process.