Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-w74x-gjhj-gxwp

Опубликовано: 20 мая 2026
Источник: github
Github: Не прошло ревью
CVSS4: 8.5
CVSS3: 7.8

Описание

PluginScript attempts to chroot the plugin to the repoManagerRoot, this root is frequently / (the system root) in standard configurations or when using --root. If the chroot target is /, it is a no-op, allowing the traversed path to execute host binaries (like /bin/bash) with root privileges.

PluginScript attempts to chroot the plugin to the repoManagerRoot, this root is frequently / (the system root) in standard configurations or when using --root. If the chroot target is /, it is a no-op, allowing the traversed path to execute host binaries (like /bin/bash) with root privileges.

EPSS

Процентиль: 12%
0.00214
Низкий

8.5 High

CVSS4

7.8 High

CVSS3

Дефекты

CWE-35

Связанные уязвимости

CVSS3: 7.8
ubuntu
3 месяца назад

`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/bash`) with root privileges.

CVSS3: 7.8
nvd
3 месяца назад

`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/bash`) with root privileges.

CVSS3: 7.8
debian
3 месяца назад

`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot ...

suse-cvrf
около 2 месяцев назад

Security update for zypper, libzypp, libsolv

suse-cvrf
около 2 месяцев назад

Security update for libsolv, libzypp, zypper

EPSS

Процентиль: 12%
0.00214
Низкий

8.5 High

CVSS4

7.8 High

CVSS3

Дефекты

CWE-35