The vulnerability lies in containerd’s CRI plugin, which propagates labels from an image configuration to a container without validation. A malicious image can set a label that causes an arbitrary command to run on the host when the plugin consumes the label. This flaw enables host‑level command execution with root privileges, leading to full compromise of the node and the cluster. The weakness is improper input validation (CWE‑20) and operating system command injection (CWE‑78).

The product at risk is containerd. Versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 contain the flaw. Any environment running containerd v1.7.32 or earlier, v2.3.1 or earlier, v2.2.4 or earlier, v2.1.8 or earlier, or v2.0.9 or earlier is affected and should be upgraded.

The CVSS score of 9.4 classifies the flaw as critical, with no authentication required and high exploitability. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalogue. The attack surface remains large because the flaw is triggered during normal image pulls by the CRI plugin. An attacker can craft a label in a malicious image that, when processed by the plugin, results in the host executing arbitrary commands, providing a straightforward path to host compromise in container orchestration environments.