The vulnerability arises from the NodeUpgradeJob handler concatenating user-controllable spec.version and spec.image values into a shell command without sanitization, allowing an authenticated user who can create or update NodeUpgradeJob resources to inject shell metacharacters and execute arbitrary commands on edge nodes with the privileges of the upgrade process. This compromise affects node confidentiality, integrity, and availability.

KubeEdge is affected; the flaw exists in releases from 1.12.0 through 1.21.1, 1.22.1, and 1.23.0, and was fixed in versions 1.21.2, 1.22.2, and 1.23.1. Legacy installations prior to v1.12.0 are not impacted.

With a CVSS score of 8.8, this is a high severity issue. The EPSS score is not available, so current exploitation probability is uncertain, but the lack of a KEV listing indicates no known active exploits. Based on the description, it is inferred that the attack vector is authenticated use of the Kubernetes API to create or update NodeUpgradeJob resources; once an attacker can do so, they can inject commands that run with the privileges of the upgrade process, granting them the ability to compromise the entire edge node.