Improper handling of packet‑capture filter parameters in NeuVector allows an authenticated user who has write permission on namespaced Runtime Policies or an attacker with access to the internal gRPC certificate key pair to inject arbitrary operating‑system commands into the privileged enforcer container. The flaw is an OS command injection that can be leveraged to run code with full node privileges, potentially compromising the confidentiality, integrity, and availability of the Kubernetes worker node.

All pre‑5.4.11, pre‑5.5.4, and pre‑5.6.2 releases of SUSE NeuVector, and any older unsupported versions.

The CVSS score of 8.8 indicates a high‑severity vulnerability. No EPSS score is disclosed, but exploitation requires authenticated access or possession of the gRPC credentials, limiting the attack surface. The flaw is not presently listed in the CISA KEV catalog. An attacker who meets the prerequisites could exploit the flaw remotely over the gRPC interface, causing the component to execute injected commands and fully compromise the node.