Prometheus Label Injection Vulnerability #10

New Issue

2026-02-02T14:46:32-05:00

jared commented

2026-02-02 14:46:32 -05:00

Lines 1991-1995 don't escape label values:

def labels(**kwargs) -> str:
pairs = [f'{k}="{v}"' for k, v in kwargs.items() if v is not None]
return '{' + ','.join(pairs) + '}' if pairs else ''

If a hostname contains ", the metrics become invalid. Fix:

def labels(**kwargs) -> str:
def escape(value):
return str(value).replace('\', '\\').replace('"', '\"').replace('\n', '\n')
pairs = [f'{k}="{escape(v)}"' for k, v in kwargs.items() if v is not None]
return '{' + ','.join(pairs) + '}' if pairs else ''

Lines 1991-1995 don't escape label values: def labels(**kwargs) -> str: pairs = [f'{k}="{v}"' for k, v in kwargs.items() if v is not None] return '{' + ','.join(pairs) + '}' if pairs else '' If a hostname contains ", the metrics become invalid. Fix: def labels(**kwargs) -> str: def escape(value): return str(value).replace('\\', '\\\\').replace('"', '\\"').replace('\n', '\\n') pairs = [f'{k}="{escape(v)}"' for k, v in kwargs.items() if v is not None] return '{' + ','.join(pairs) + '}' if pairs else ''

jared referenced this issue from a commit

2026-02-10 13:22:32 -05:00

Escape special characters in Prometheus metric labels

jared closed this issue

2026-02-10 13:22:32 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/hwmonDaemon#10