Inspektor Gadget outputs eBPF event strings in columns mode without sanitizing ANSI escape characters, allowing a malicious payload to embed terminal control codes. Such injection can change the appearance of the terminal, hide or distort operator data, and potentially mislead or confuse users during interactive sessions. The flaw is a moderate severity issue tied to CWE-150, which deals with manipulating control characters.

The vulnerability applies to the Inspektor Gadget toolset from the Linux Foundation. All releases prior to version 0.49.1 lack the sanitization fix. The advisory and release notes indicate that 0.49.1 and later incorporate the necessary corrections, so any installation using an older version is considered vulnerable.

The CVSS score of 6.9 indicates a moderate risk, while the EPSS score of less than 1% points to a very low probability of exploitation at present. The issue does not appear in the CISA KEV catalog, suggesting no known widespread attacks. Based on the description, the likely attack vector is an untrusted or compromised container that can inject forged eBPF events containing malicious ANSI sequences into the monitoring pipeline. The impact is confined to terminal manipulation and does not grant system compromise or data exfiltration, but it can undermine situational awareness for operators.