{"id":"GO-2025-3981","revision":"20665955879e41a4a9f23efadf4d0a56","records":[{"revision":"20665955879e41a4a9f23efadf4d0a56","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3981","aliases":["CVE-2025-59823","GHSA-227x-7mh8-3cf6"],"title":"Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws","description":"Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws","state":0,"publishedAt":"2025-10-23T16:25:09+00:00","modifiedAt":"2026-03-03T04:56:56.726123+00:00","affected":[{"ecosystem":"Go","name":"github.com/gardener/gardener-extension-provider-aws","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.64.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gardener/gardener-extension-provider-azure","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.55.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gardener/gardener-extension-provider-gcp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.46.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gardener/gardener-extension-provider-openstack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.49.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6","https://nvd.nist.gov/vuln/detail/CVE-2025-59823","https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2","https://github.com/gardener/gardener-extension-provider-azure/commit/4573a4404969f89781ed6cf72e90554bc6ae2020","https://github.com/gardener/gardener-extension-provider-gcp/commit/51111b4f60c33c60dfdf18b1fc50f7ec8d8f70ac","https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8","https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0","https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0","https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0","https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3981","license":"OSV · upstream source license applies","key":"osv:GO-2025-3981","identifiers":["GO-2025-3981","CVE-2025-59823","GHSA-227x-7mh8-3cf6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}