The /registercrd endpoint in KubePlus 4.14’s kubeconfiggenerator component processes user‑supplied chartName data by directly concatenating it into a shell command executed via subprocess.Popen with shell=True. This lack of input sanitization allows an attacker to embed malicious shell commands, enabling unrestricted code execution on the host system. The weakness is a classic command injection.

KubePlus version 4.14, specifically the kubeconfiggenerator component whose /registercrd API endpoint accepts a chartName parameter.

The vulnerability has a CVSS score of 8.8, indicating high severity, but an EPSS score of less than 1% shows low exploitation probability. It is not in the KEV catalog. The likely attack vector is remote; an attacker must be able to send a crafted HTTP request to the /registercrd endpoint, which may be available to privileged users or exposed on the internet. If exploited, the attacker gains full control over the vulnerable service.