ConfigUpdateJob processing in KubeEdge concatenates user‑controlled updateFields values into a system shell command without sanitization, allowing an attacker who can create or modify these resources to inject arbitrary shell commands. The flaw permits execution of code with the privileges of the KubeEdge process on the target edge node, enabling full compromise of that node.

The vulnerability affects KubeEdge version 1.21.0 through 1.21.2, 1.22.2, and 1.23.1. Edge nodes running these affected releases are at risk; later versions contain a fix and are not impacted.

The flaw has a CVSS score of 8.8 and is not listed in the CISA KEV catalog. No EPSS score is available. An attacker with permission to create or modify ConfigUpdateJob resources can exploit the unescaped shell invocation to execute commands, leading to remote code execution on the edge node. The attack surface is limited to authenticated users with resource‑level write permissions, making the exploitation probability contingent on the privilege model of the cluster.