{"action":"Upgrade github.com/gardener/gardener-extension-provider-openstack to 1.49.0 or later.","affected":[{"fixed":"1.49.0","introduced":"0"}],"component":"github.com/gardener/gardener-extension-provider-openstack","cve_ids":["CVE-2025-59823"],"ecosystem":"Go","epss":0.00529,"exploited":false,"fixed_versions":["1.49.0"],"ghsa_id":"GHSA-227x-7mh8-3cf6","id":"tcs_01M5KER8TXMPPMKBC4PCWWFNVS","modified_at":"2025-10-23T20:12:12Z","published_at":"2025-09-25T16:39:16Z","references":["https://osv.dev/vulnerability/GHSA-227x-7mh8-3cf6","https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6","https://nvd.nist.gov/vuln/detail/CVE-2025-59823","https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2","https://github.com/gardener/gardener-extension-provider-azure/commit/4573a4404969f89781ed6cf72e90554bc6ae2020","https://github.com/gardener/gardener-extension-provider-gcp/commit/51111b4f60c33c60dfdf18b1fc50f7ec8d8f70ac","https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8","https://github.com/gardener/gardener-extension-provider-aws","https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0","https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0","https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0","https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0","https://pkg.go.dev/vuln/GO-2025-3981"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-227x-7mh8-3cf6#Go/github.com/gardener/gardener-extension-provider-openstack","url":"https://osv.dev/vulnerability/GHSA-227x-7mh8-3cf6"}],"summary":"Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning"}