CVE-2026-54574

creationtimestamp| type| source ---|---|--- 2026-07-29 17:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsih6ubzv2j 2026-07-29 18:35:11+00:00| published-proof-of-concept| https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7 2026-07-30 01:32:06+00:0...

CVE-2026-54574

CVE-2026-54574 affects proot-distro prior to 5.1.5. The flaw resides in extraction paths: _extract_plain_tar() (proot_distro/commands/install.py) and _apply_layer() (proot_distro/helpers/docker.py) do not validate symlink targets (member.linkname). A tar archive can plant an absolute host-path sy...