CVE-2026-128079

envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in install.pythonpackagesrequirements=... could allow access to files outside the build context. An attacker...