| Package | Affected versions | Patched versions |
|---|---|---|
| buildkit | ≥ 0.30.0, < 0.31.2 | 0.31.2 |
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free