Google Osv Scalibr vulnerabilities

3 vulnerabilities

Known vulnerabilities in Google Osv Scalibr, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

1.9CVE-2025-13425chainguardgoogle-osconfig-agent+2
EPSS score
0.11%
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.6.5CVE-2025-5981github.com/googleosv-scalibr+1
EPSS score
0.22%
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.6.9CVE-2026-102252googleosv-scalibr
EPSS score
0.09%
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.