https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 19:29:00 +0000 https://db.gcve.eu/vuln/ghsa-jv6m-48w5-5rpr <p><strong>Affected:</strong> PyPI: envd</p> <p>### Summary</p> <p>envd’s `install.python_packages(requirements=...)` could read files outside the build context on the host. Content interpreted as dependency entries could appear in build logs and build-step metadata.</p> <p>Commit f576c92, released in v1.3.5, added path containment validation but left a time-of-check/time-of-use (TOCTOU) race between symlink resolution and opening the requirements file. Commit 9d575b3 addresses this race by opening requirements files through a directory-rooted filesystem handle.</p> <p>### Details</p> <p>envd reads requirements files on the host to determine whether their contents can be embedded directly into a pip installation build step.</p> <p>The vulnerable host-side requirements read was introduced in v0.3.38. Version v1.3.5 added containment checks for static path escapes but remained vulnerable to a TOCTOU race. The complete fix is included in v1.3.6.</p> <p>Before f576c92, this host read lacked a build-context containment check. That commit added frontend path validation and a compile-time check using filepath.EvalSymlinks followed by a containment comparison.</p> <p>However, symlink resolution returns a pathname rather than a pinned filesystem object. The subsequent os.Open independently resolves that pathname. Concurrent filesystem changes could therefore invalidate the containment check before the file was opened.</p> <p>The complete fix uses os.OpenRoot and Root.Open to enforce containment during filesystem traversal.</p> <p>Resources: - first commit: be783264fdd79ad7262cea0485b…</p> <p><strong>Affected:</strong> PyPI: envd</p> <p>### Summary</p> <p>envd’s `install.python_packages(requirements=...)` could read files outside the build context on the host. Content interpreted as dependency entries could appear in build logs and build-step metadata.</p> <p>Commit f576c92, released in v1.3.5, added path containment validation but left a time-of-check/time-of-use (TOCTOU) race between symlink resolution and opening the requirements file. Commit 9d575b3 addresses this race by opening requirements files through a directory-rooted filesystem handle.</p> <p>### Details</p> <p>envd reads requirements files on the host to determine whether their contents can be embedded directly into a pip installation build step.</p> <p>The vulnerable host-side requirements read was introduced in v0.3.38. Version v1.3.5 added containment checks for static path escapes but remained vulnerable to a TOCTOU race. The complete fix is included in v1.3.6.</p> <p>Before f576c92, this host read lacked a build-context containment check. That commit added frontend path validation and a compile-time check using filepath.EvalSymlinks followed by a containment comparison.</p> <p>However, symlink resolution returns a pathname rather than a pinned filesystem object. The subsequent os.Open independently resolves that pathname. Concurrent filesystem changes could therefore invalidate the containment check before the file was opened.</p> <p>The complete fix uses os.OpenRoot and Root.Open to enforce containment during filesystem traversal.</p> <p>Resources: - first commit: be783264fdd79ad7262cea0485b…</p> https://db.gcve.eu/vuln/ghsa-jv6m-48w5-5rpr