Më 6 nëntor 2026, GitHub publikoi këshillën e sigurisë GHSA-fmc8-p6q7-75cc për një dobësi me rrezikshmëri kritike (CVSS 9.9) në paketën github.com/canonical/lxd të ekosistemit Go.
Paketat e prekura
- github.com/canonical/lxd (Go) — versionet e prekura:
< 0.0.0-20260630083100-c5184be310b1; versioni me rregullim:0.0.0-20260630083100-c5184be310b1
Detaje
- Rrezikshmëria: Kritike (CVSS 9.9)
- CWE: CWE-20 (Improper Input Validation)
- Identifikuesit: GHSA-fmc8-p6q7-75cc
Përmbledhja zyrtare (në anglisht)
LXD has argument injection in backup compression algorithm leading to AFW and ACE — Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Details Incus validates compression_algorithm by parsing it into fields and checking only the first token against an allowlist: Extra arguments are not rejected. compressFile() then prepends -c and passes the remaining user-supplied fields to the compressor: With a value like: the daemon executes the…
Çfarë duhet të bëni
Nëse projektet tuaja përdorin github.com/canonical/lxd, përditësojeni sa më shpejt në versionin 0.0.0-20260630083100-c5184be310b1 ose më të ri.
