Vulnerability GHSA-6rxq-q92g-4rmf
Advisory details are being prepared in the background.
High Risk
HIGH RISK
CVSS Score: 8.2
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
8 months ago
March 01, 2026 at 01:28 AM UTC
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories
v1.25.4 - v1.25.9
v1.25.4 - v1.25.9
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko
v0.1.0 - v1.25.19 GO-2026-6902
v0.1.0 - v1.25.19 GO-2026-6902
Critical
15 hours ago
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
v0.1.0 - v1.25.19 GHSA-5q7h-w9jf-cx97
v0.1.0 - v1.25.19 GHSA-5q7h-w9jf-cx97
Unknown
8 months ago
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko
v1.25.4 - v1.25.9 GO-2026-4580
v1.25.4 - v1.25.9 GO-2026-4580
Impacted packages
Timeline
Published
8 months ago
March 01, 2026 at 01:28 AM UTC
Last Modified
7 months ago
March 23, 2026 at 04:56 AM UTC