Critical
Security advisory
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-10906
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 09:43 UTC · Revision 1
Source evidence
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
osv:CVE-2017-10906
Complete source record
{
"id": "d1e8d5a8b81e3a1508136effe08d5eb23f80bb0a3a4ff379a9fdd539c4fc26bd",
"url": "https://osv.dev/vulnerability/CVE-2017-10906",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-10906",
"summary": "Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.",
"evidence": "osv:CVE-2017-10906",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2017-10906",
"aliases": [
"CVE-2017-10906",
"GHSA-5jrp-w8fr-mrww"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/fluent/fluentd",
"type": "GIT",
"events": [
{
"introduced": "cd458194c949851a2b76c06b994330e964b55cc0"
},
{
"last_affected": "d5e0a61e06a7cfeb7266b018e77ac74f85c0c06d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.29:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.29"
},
{
"last_affected": "0.12.29"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.30:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.30"
},
{
"last_affected": "0.12.30"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.31:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.31"
},
{
"last_affected": "0.12.31"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.32:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.32"
},
{
"last_affected": "0.12.32"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.33:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.33"
},
{
"last_affected": "0.12.33"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.34:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.34"
},
{
"last_affected": "0.12.34"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.35:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.35"
},
{
"last_affected": "0.12.35"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.36:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.36"
},
{
"last_affected": "0.12.36"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.37:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.37"
},
{
"last_affected": "0.12.37"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.38:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.38"
},
{
"last_affected": "0.12.38"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.39:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.39"
},
{
"last_affected": "0.12.39"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:fluentd:fluentd:0.12.40:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.12.40"
},
{
"last_affected": "0.12.40"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"0.12.29",
"0.12.30",
"0.12.31",
"0.12.32",
"0.12.33",
"0.12.34",
"0.12.35",
"0.12.36",
"0.12.37",
"0.12.38",
"0.12.39",
"0.12.40",
"v0.12.40",
"v0.12.39",
"v0.12.38",
"v0.12.37",
"v0.12.36",
"v0.12.35",
"v0.12.34",
"v0.12.33",
"v0.12.32",
"v0.12.31",
"v0.12.30",
"v0.12.29"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-10906.json"
}
}
],
"modified": "2026-10-20T10:47:42.720704970Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:2225",
"https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes",
"https://jvn.jp/en/vu/JVNVU95124098/index.html",
"https://github.com/fluent/fluentd/pull/1733"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:openstack",
"extracted_events": [
{
"range": [
{
"introduced": "13"
},
{
"last_affected": "13"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-10906",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 379649,
"published_at": "2017-12-08T15:29:00.26+00:00"
}