Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GO-2026-6127
  • Go/github.com/fission/fission
 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission 18 Aug
  • Fix available
GO-2026-6129
  • Go/github.com/fission/fission
 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption in github.com/fission/fission 18 Aug
  • Fix available
GO-2026-6130
  • Go/github.com/fission/fission
 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape in github.com/fission/fission 18 Aug
  • Fix available
GO-2026-6131
  • Go/github.com/fission/fission
 Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks in github.com/fission/fission 18 Aug
  • Fix available
GHSA-r5jh-q2mw-gcx4
  • Go/github.com/fission/fission
 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape 28 Jul
  • Fix available
  • Severity - 3.6 (Low)
GHSA-q6vm-xqc9-v3ff
  • Go/github.com/fission/fission
 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory 28 Jul
  • Fix available
  • Severity - 7.7 (High)
GHSA-vchh-r53j-8mpw
  • Go/github.com/fission/fission
 Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks 28 Jul
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-qf5v-m7p4-95rp
  • Go/github.com/fission/fission
 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption 28 Jul
  • Fix available
  • Severity - 8.5 (High)
GO-2026-5860
  • Go/github.com/fission/fission
 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5846
  • Go/github.com/fission/fission
 Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5849
  • Go/github.com/fission/fission
 Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5850
  • Go/github.com/fission/fission
 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5852
  • Go/github.com/fission/fission
 Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5854
  • Go/github.com/fission/fission
 Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5855
  • Go/github.com/fission/fission
 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape in github.com/fission/fission 07 Jul
  • Fix available
GO-2026-5857
  • Go/github.com/fission/fission
 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission 07 Jul
  • Fix available
Load more...