Google Osv-Scalibr vulnerabilities
3 known vulnerabilities affecting google/osv-scalibr.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM2LOW1
Vulnerabilities
Page 1 of 1
CVE-2025-5981P3MEDIUMCVSS 6.5≥ 0.1.3, < 0.1.82025-06-18
CVE-2025-5981 [MEDIUM] CWE-427 CVE-2025-5981: Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability w
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
nvd
CVE-2026-102252P4MEDIUMCVSS 6.9≥ 0.3.6, < 0.5.12026-09-29
CVE-2026-102252 [MEDIUM] CWE-22 CVE-2026-102252: A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCAL
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destina
nvd
CVE-2025-13425P4LOWCVSS 1.9fixed in 0.3.42025-11-20
CVE-2025-13425 [LOW] CWE-476 CVE-2025-13425: A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overind
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
nvd