Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0819

NIXPKGS-2026-0819
published on 28 Mar 2026
Permalink CVE-2026-33747
8.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 18 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 1 day, 10 hours ago
  • @LeSuisse removed
    7 packages
    • buildkit-nix
    • buildkite-cli
    • buildkite-agent
    • buildkite-agent-metrics
    • buildkite-test-collector-rust
    • terraform-providers.buildkite
    • terraform-providers.buildkite_buildkite
    18 hours ago
  • @LeSuisse accepted 18 hours ago
  • @LeSuisse published on GitHub 18 hours ago
BuildKit vulnerable to malicious frontend causing file escape outside of storage root

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

References

Affected products

buildkit
  • ==< 0.28.1

Matching in nixpkgs

Ignored packages (7)

Package maintainers

Advisory: https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj