Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
moby/buildkit
master @ 28fb74f
82
Fixes
7
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 34 prior fixes. Scrutinize any change in this area.
executor/oci: most-fixed (9 issues). Treat as high-risk during review.
28 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Git checkout operations and URL fragment subdirectories have repeatedly failed to validate subpath boundaries, allowing symbolic link traversal outside the repository root. This is tracked in CVE-2026-33748.
Sandbox Escape: Misconfigured namespace specs and missing default seccomp profiles allow containerized environments to manipulate host resources or bypass namespace isolation.
Auth Bypass: Bypassing security entitlement checks allows untrusted frontends or malicious build specifications to execute unconfined or highly privileged actions, leading to privilege escalation as noted in CVE-2024-23653.