Skip to content

Commit ea777bf

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-vp62-r36r-9xqp GHSA-wjxp-xrpv-xpff
1 parent 673c727 commit ea777bf

File tree

2 files changed

+131
-0
lines changed

2 files changed

+131
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-vp62-r36r-9xqp/GHSA-vp62-r36r-9xqp.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vp62-r36r-9xqp",
4+
"modified": "2026-04-21T18:51:21Z",
5+
"published": "2026-04-21T18:51:21Z",
6+
"aliases": [
7+
"CVE-2026-39861"
8+
],
9+
"summary": "Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace",
10+
"details": "Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection.\n\nUsers on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.\n\nClaude Code thanks hackerone.com/philts for reporting this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@anthropic-ai/claude-code"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.1.64"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39861"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/anthropics/claude-code"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22",
55+
"CWE-61"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-21T18:51:21Z",
60+
"nvd_published_at": "2026-04-21T01:16:06Z"
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-wjxp-xrpv-xpff/GHSA-wjxp-xrpv-xpff.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wjxp-xrpv-xpff",
4+
"modified": "2026-04-21T18:52:18Z",
5+
"published": "2026-04-21T18:52:18Z",
6+
"aliases": [
7+
"CVE-2026-40161"
8+
],
9+
"summary": "Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL",
10+
"details": "### Summary\n\nThe Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled `serverURL` when the user omits the `token` parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing `serverURL` to an attacker-controlled endpoint.\n\n### Details\n\nThe git resolver's `ResolveAPIGit()` function in `pkg/resolution/resolver/git/resolver.go` constructs an SCM client using the user-supplied `serverURL` and a token obtained via `getAPIToken()`.\n\nWhen the user provides `serverURL` but omits the `token` parameter:\n\n1. `getSCMTypeAndServerURL()` reads `serverURL` directly from user params (`params[ServerURLParam]`) with no validation against the system-configured URL.\n\n2. `secretRef` is set to `nil` because the user did not provide a token parameter.\n\n3. `getAPIToken(ctx, nil, APISecretNameKey)` is called. It detects `apiSecret == nil`, creates a new `secretCacheKey`, and populates it from the system-configured secret (`conf.APISecretName` / `conf.APISecretNamespace` / `SYSTEM_NAMESPACE`).\n\n4. `clientFunc(scmType, serverURL, string(apiToken))` creates an SCM client pointed at the attacker-controlled URL with the system token. The SCM factory sets the token as an `Authorization` header on the HTTP client.\n\n5. All subsequent API calls (`Contents.Find`, `Git.FindCommit`) carry the system token to the attacker URL.\n\n### Impact\n\nThe system Git API token (GitHub PAT, GitLab token, etc.) is exfiltrated to an attacker-controlled endpoint. This token typically has read access to private repositories containing source code, secrets, and CI/CD configurations.\n\nThis follows the same threat model as GHSA-j5q5-j9gm-2w5c (published March 2026): a namespace-scoped tenant with permission to create TaskRuns exploits the git resolver to exfiltrate credentials. The prior advisory involved reading the resolver pod's ServiceAccount token via path traversal. This finding involves redirecting the system Git API token via `serverURL`.\n\n### Patches\n\n_(to be filled in after fix is merged and released)_\n\nThe fix validates that when `serverURL` is user-provided and differs from the system-configured server URL, the user must also provide their own `token` parameter. Using the system token with a non-system server URL is rejected.\n\n### Workarounds\n\n- **Do not configure a system-level API token** in the git resolver ConfigMap. Instead, require all users to provide their own tokens via the `token` parameter.\n- **Restrict TaskRun creation** — limit which users or ServiceAccounts can create TaskRuns and PipelineRuns that use the git resolver.\n- **Network egress policies** — apply `NetworkPolicy` to the `tekton-pipelines-resolvers` namespace to restrict outbound traffic to known-good Git servers only.\n\n### Affected Versions\n\nAll releases from **v1.0.0** through **v1.10.0**, including all patch releases. The API mode of the git resolver has been present since the resolver was introduced.\n\nReleases prior to v1.0.0 are not affected because the git resolver either did not exist or did not have API mode.\n\n### Acknowledgments\n\nThis vulnerability was reported by Koda Reef (@kodareef5), who provided a detailed analysis and proof-of-concept. Thank you!\n\n### References\n\n- Prior advisory: [GHSA-j5q5-j9gm-2w5c](https://github.com/tektoncd/pipeline/security/advisories/GHSA-j5q5-j9gm-2w5c)\n- Related: #9608 (deprecate `api-token-secret-namespace`)\n- Related: #9609 (SubjectAccessReview for resolver secrets)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/tektoncd/pipeline"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.0.0"
29+
},
30+
{
31+
"last_affected": "1.10.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-wjxp-xrpv-xpff"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40161"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/tektoncd/pipeline/issues/9608"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/tektoncd/pipeline/issues/9609"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/tektoncd/pipeline"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-201"
63+
],
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-21T18:52:18Z",
67+
"nvd_published_at": "2026-04-21T17:16:53Z"
68+
}
69+
}

0 commit comments

Comments
 (0)