Github.Com Google Osv-Scalibr vulnerabilities
2 known vulnerabilities affecting github.com/google_osv-scalibr.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM1LOW1
Vulnerabilities
Page 1 of 1
CVE-2025-5981P3MEDIUM≥ 0.1.3, < 0.2.12025-06-18
CVE-2025-5981 [MEDIUM] CWE-22 OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
ghsaosv
CVE-2025-13425P4LOW≥ 0, < 0.3.42025-11-20
CVE-2025-13425 [LOW] CWE-476 OSV-SCALIBR has NULL Pointer Dereference
OSV-SCALIBR has NULL Pointer Dereference
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
ghsaosv