CVE-2026-15793

Summary

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

Affected Software

VendorProductVersion RangeStatus
mobyBuildKit0.30.0 <= 0.31.1affected

Weaknesses

  • CWE-88: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Workarounds

The issue requires using a custom frontend together with a malicious Git source. Current Dockerfile builds are not affected.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References