Loading...
Skip to main content
GeekWala

CVE-2017-10906 — Vulnerability in fluentd — CVE Details

CRITICAL

Fluentd Escape Sequence Injection Vulnerability

Published May 13, 2022Updated December 5, 2024Source: osv

Summary

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

Advisory Timeline

  • First published May 13, 2022 (1613 days ago).
  • Last revised December 5, 2024 — 937 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update fluentd to 0.12.41 or later
gem install fluentd -v 0.12.41

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
fluentd
rubygems
0.12.29, 0.12.30, 0.12.31, 0.12.32 (+8 more)0.12.41

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2017-10906?
Fluentd Escape Sequence Injection Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2017-10906?
CVE-2017-10906 affects fluentd. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2017-10906 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-5jrp-w8fr-mrww

Related CVEs

  • CVE-2026-44024
    CRITICAL

    Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

  • CVE-2026-55107
    CRITICAL

    kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

  • CVE-2026-77602
    CRITICAL

    OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

  • CVE-2026-44161
    HIGH

    Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

  • CVE-2026-44160
    HIGH

    Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

  • CVE-2026-44025
    HIGH

    Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies