k8sGPT has Prompt Injection through its k8sGPT-Operator

Executive brief

### Summary In the auto-remediation pipeline, `object_to_execution.go` was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.

### Details This issue was fixed after coordination with Alex Jones.

### PoC To minimize the impact, the PoC of this vulnerability wasn't released, but was shared with the maintainers.

Affected products

• Go github.com/k8sgpt-ai/k8sgpt

References

• https://api.github.com/users/haruki3hhh
• https://github.com/haruki3hhh
• https://api.github.com/users/haruki3hhh/gists%7B/gist_id%7D
• https://api.github.com/users/haruki3hhh/repos
• https://avatars.githubusercontent.com/u/135201297?v=4
• https://api.github.com/users/haruki3hhh/events%7B/privacy%7D