CVE-2026-20613

The ArchiveReader.extractContents() function in the containerization project (used by cctl image load and container image load) fails to perform pathname validation during archive extraction. This flaw allows a maliciously constructed archive to use relative pathnames to extract files into any us...

CVE-2026-64777

The container tool (version prior to 1.2.0 ) is vulnerable to an improper limitation of a pathname to a restricted directory. A malicious builder peer can request an in-context file by name from the host and potentially receive the contents of any file the name resolves to, even if the resolution...

CVE-2026-28909

The container tool, an open-source tool by Apple for running Linux containers on Mac devices, is vulnerable to credential exposure in versions prior to 0.12.3 . The root cause is a flaw where hostnames matching specific bypass patterns allow users to connect to malicious registries, resulting in ...