A high-severity CRLF injection vulnerability in Incus allows an authenticated user to achieve arbitrary command execution on the host, necessitating an immediate update to version 6.21.0 or 6.0.6.

The software fails to properly neutralize CRLF sequences in environment variables used within custom YAML container configurations. This flaw allows an authenticated user, such as a member of the incus group, to perform newline injection and insert unauthorized lifecycle hooks, leading to command execution on the host.

This vulnerability carries a CVSS score of 8.7, reflecting a high risk of total system compromise. Successful exploitation grants an attacker the ability to escape container restrictions and execute arbitrary commands on the host operating system, which could lead to complete data exfiltration, unauthorized access to sensitive infrastructure, and severe service disruption.

Immediate Action: Update Incus to version 6.21.0 or 6.0.6 as soon as these versions are available from the vendor.

Proactive Monitoring: Review system logs and container configuration files for anomalous environment variable definitions or unexpected lifecycle hook entries.

Compensating Controls: Restrict membership of the incus group to only highly trusted administrative users to minimize the attack surface until patches can be applied.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up and files referenced in the official GitHub advisory.

Given the potential for full host system compromise, this vulnerability should be treated with high urgency. Administrators must monitor the official Incus repository for the release of versions 6.21.0 and 6.0.6, and apply these updates immediately upon availability. Until the patch is applied, limit administrative access to the container manager to prevent exploitation by unauthorized or malicious users.