Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opencontainers/runc

              main @ c5cd236
            

161

Fixes

CVEs

CRITICAL

Peak severity

20.0%

Coverage

Highlights

Path Traversal: 50 prior fixes. Scrutinize any change in this area.

libcontainer: most-fixed (64 issues). Treat as high-risk during review.

104 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Attackers can exploit symlink-exchange and mount-target race conditions in shared directories during container startup to traverse outside the rootfs, potentially rewriting host files or obtaining container breakouts. Historically tracked under CVE-2025-52881, CVE-2021-30465, and CVE-2024-45310.

Sandbox Escape: File descriptor leaks and unverified references to /proc/self/exe have historically permitted malicious containerized processes to access and overwrite the host's runc binary, leading to arbitrary host-level execution (CVE-2019-5736, CVE-2024-21626).

Auth Bypass: Insufficient verification of default system files and bind-mount sources (such as dev/null masking) can allow local container attackers to perform arbitrary mount gadget attacks and bypass system policy rules (CVE-2025-31133).