Loading story…
Two high-severity vulnerabilities in BuildKit could let attackers access or write files outside intended build boundaries. CVE-2026-33747 affects BuildKit versions prior to 0.28.1 and allows a malicious custom frontend to craft API messages that write files outside the BuildKit state directory for the execution context. The issue is exploitable when an untrusted frontend is invoked through #syntax or --build-arg BUILDKIT_SYNTAX; commonly used trusted frontend images such as docker/dockerfile are not affected. The flaw is tracked as CWE-22 and carries a CVSS v3.1 vector of AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
A second flaw, CVE-2026-33748, also patched in BuildKit 0.28.1, stems from improper validation of Git URL fragment subdir components and can expose files outside the checked-out repository root. The impact is limited to files on the same mounted filesystem and affects builds that use Git URLs with a subpath component, particularly where untrusted repository paths may resolve through symlinks. Maintainers fixed both issues in version 0.28.1 and advised users to avoid untrusted frontends, untrusted Dockerfile sources, and untrusted Git repository subdirectory inputs until patched.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
BuildKit version 0.28.1 was identified as the release that fixes CVE-2026-33747 and CVE-2026-33748. The fixes were documented in the associated GitHub security advisory and release notes.
Two vulnerabilities affecting BuildKit versions prior to 0.28.1 were publicly documented: one allowing malicious frontends to write files outside the BuildKit state directory, and another allowing Git URL subdir handling to access files outside the checked-out repository root. Both issues were published with remediation guidance and linked to the same fixed release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2025-48384** affects Git’s handling of configuration values containing trailing carriage returns, creating a path for unintended script execution during submodule initialization. According to Armis, the flaw can be abused when an attacker can influence the relevant configuration context, potentially turning routine clone or submodule operations into code execution. Microsoft’s Security Update Guide also lists the issue, identifying it as a Git/GitHub vulnerability. Public exploit activity quickly followed disclosure, with multiple GitHub repositories publishing proof-of-concept material for **CVE-2025-48384**, including variants described as working over HTTPS and others explicitly labeling the issue as carriage-return-driven remote code execution on cloning. The appearance of several PoC repositories indicates that exploit details are broadly accessible, increasing the likelihood of weaponization against developers and build environments that process untrusted repositories or submodules.
Jun 29, 2026
A high-severity flaw in **Dulwich** tracked as `CVE-2026-42305` allows arbitrary file write and potential remote code execution on Windows when a user clones, fetches, or checks out a malicious Git repository. The bug affects versions `0.10.0` through `1.2.4` and stems from improper validation of tree entry names that Windows interprets as path syntax, including backslashes, NTFS alternate data stream markers, and NTFS `8.3` short-name aliases tied to `.git`. A crafted repository can write files outside the work tree or place executable content such as `.git\hooks\pre-commit.exe` inside the victim’s Git metadata, which Git for Windows may later execute in the user’s context. The project released **Dulwich 1.2.5** to fix the issue, correcting mishandled `core.protectNTFS` and `core.protectHFS` configuration names, enabling `core.protectNTFS` by default on all platforms, and tightening checks to block dangerous names including reserved Windows devices like `CON`, `NUL`, `COM1`, and `LPT1`. Release notes say the update also addresses other security bugs, including unsafe submodule path handling, shell command injection in `ProcessMergeDriver`, unsafe patch filename generation, and improper `receive.maxInputSize` enforcement. Maintainers said there is no effective workaround short of upgrading, and warned that even POSIX users can unknowingly propagate malicious trees to Windows users through pushes or republished repositories.
Jun 29, 2026
Two high-severity vulnerabilities in **GitPython** allowed attackers to bypass built-in safety checks and reach arbitrary command execution through Git operations. **CVE-2026-42215** affects versions `3.1.30` through `3.1.46` and stems from GitPython validating blocked Git options before normalizing Python keyword arguments: values such as `upload_pack` could pass validation, then be converted into forbidden flags like `--upload-pack` when passed to `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`. The flaw could let attacker-controlled input trigger command execution with the privileges of the Python process even when `allow_unsafe_options=False`. A second flaw, **CVE-2026-42284**, affects GitPython before version `3.1.47` and involves unsafe handling of the `multi_options` parameter in `_clone()`. The library checked `multi_options` before later reprocessing it with `shlex.split(" ".join(multi_options))`, enabling crafted input to smuggle additional Git command-line arguments past validation. A string that appeared to be a valid branch selection could be split into separate options, including malicious configuration such as `core.hooksPath`, causing Git to execute attacker-controlled hooks during clone. Both issues were fixed in **GitPython `3.1.47`**.
Jun 29, 2026