CVE-2026-15793
EUVD-2026-4631221.07.2026, 17:17
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mobyproject | buildkit | 0.30.0 ≤ 𝑥 < 0.31.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases