KubeEdge NodeUpgradeJob RCE Vulnerability Fixed in v1.23.1, v1.22.2, v1.21.2

The KubeEdge project has addressed a high-severity security vulnerability in its NodeUpgradeJob handler, as detailed in a GitHub Security Advisory. The issue allowed authenticated users with permissions to create or update NodeUpgradeJob resources via the v1alpha2 API to execute arbitrary commands on edge nodes. This was possible because the handler constructed shell commands by concatenating user-controlled `spec.version` and `spec.image` fields, enabling command injection through shell metacharacters. Successful exploitation could compromise the confidentiality, integrity, and availability of edge nodes.

The fix eliminates shell-based command construction and instead uses structured argument lists with `exec.Command`, ensuring that version and image values are passed as separate literals. Patched versions include KubeEdge v1.23.1, v1.22.2, and v1.21.2. Operators are advised to upgrade to one of these versions to mitigate the risk.

Before upgrading, operators should verify whether any existing automation or scripts rely on the previous shell-based command behavior, as these may need adjustments to align with the new structured argument handling. Additionally, environments with untrusted users should review permissions for NodeUpgradeJob resources and consider implementing the suggested workarounds if immediate upgrading is not feasible. This vulnerability highlights the importance of scrutinizing API-driven resource updates, particularly in edge computing contexts where node compromise can have cascading effects.