high7.5
CVE-2026-15793
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources.
Impact
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mobyproject | Buildkit | from 0.30.0 before 0.31.2 |