Unverified50% confidenceFactExact time
kubectl exec does not directly modify objects itself, but it can execute arbitrary processes inside a container, so the validator lists it together with delete and scale as deny words.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
Unverifiedexecline采用链式执行模型，每个命令通过exec()系统调用替换自身为下一个命令，没有常驻解释器进程68% similarUnverifiedThe validator allows specific binaries and subcommands, outright rejects write operation verbs, rejects pipes to a shell, and fails closed on anything it does not recognize.68% similarUnverifiedThe correct approach to fixing command injection is to use execFile with a separate argument array, reject non-compliant branch text with a strict regular expression, and set a timeout.61% similarUnverifiedWhen a policy determines that a request is not permitted, OpenController directly rejects the call in the request path, using inline enforcement rather than post-hoc auditing60% similarUnverifiedLinux的seccomp可以白名单方式限制进程可调用的系统调用集合，例如禁止AI进程使用execve或socket等高危调用60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1059212API
curl https://kongchang.com/api/v1/knowledge/claims/1059212MCP
get_claim(id=1059212)