CVE Intelligence

Google OSV-SCALIBR vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Google OSV-SCALIBR: 2 record(s), with affected versions and fixes.

CVE-2026-102252 Medium · 6.9 CWE-22 Sep 29, 2026
Path Traversal in VMDK Extractor in OSV-SCALIBR
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.
CVE-2025-13425 Low · 1.9 CWE-476 Nov 20, 2025
Denial of Service in OSV-SCALIBR
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.