The Air Traffic Controller (ATC) component of Yoke releases 0.19.0 and earlier accepts an annotation named overrides.yoke.cd/flight that points to a WebAssembly module. The controller downloads and executes the module without validating the URL. An attacker who has permission to create or update resources can supply a malicious URL, causing the ATC to run arbitrary WASM code in its own context. This ability allows the attacker to create arbitrary Kubernetes resources and may enable escalation to cluster‑admin level.

Yoke, produced by yokecd, is affected when its version is 0.19.0 or older. The vulnerability resides in the ATC component of the infrastructure‑as‑code deployment tool.

The CVSS v3.1 base score is 8.8, indicating a high severity vulnerability. The EPSS score is below 1%, suggesting a limited probability of exploitation at present. The issue is not listed in CISA's KEV catalog. The likely attack vector is through the injection of a malicious URL in the overrides.yoke.cd/flight annotation by a user with create/update permissions; the ATC controller then executes the downloaded WASM code, granting the attacker the controller's privileges.