Important: runfinch-finch

Issue Overview: A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3140)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3140 advisory. A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to acce...

Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-142)

The version of runfinch-finch installed on the remote host is prior to 1.19.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-142 advisory. A custom client can produce such an upload request to the BuildKit daemon that files can escape from the...

Important: runfinch-finch

Issue Overview: A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15793: Improper Neutralization of Argument Delimiters in a Command

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

Design/Logic Flaw

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...