Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/chainguard-dev/kaniko

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2GoPublished

    kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories

    CVE-2026-28406 · GHSA-6rxq-q92g-4rmf

    Affected
    • Go github.com/chainguard-dev/kaniko >= 1.25.4, < 1.25.10
    Fixed in
    1.25.10· Vendor fix available
    Issue
    kaniko unpacks build context archives using filepath.Join(dest, cleanedName) without enforcing that the final path stays within dest. A tar entry like ../outside.txt escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Affected versions = 1.25.4, <= 1.25.9. Fix: Merged with PR #326 — uses securejoin for path resolution in tar extraction. Acknowledgements kaniko thanks Oleh Konko from 1seal for discovering and reporting this issue.

    Recommended action: Upgrade to 1.25.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →