CVE-2026-15793: Git source checkout from a bundle file could lead to command injection
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15793?
The severity of CVE-2026-15793 is high with a CVSS score of 7.3.
How do I fix CVE-2026-15793?
To mitigate CVE-2026-15793, ensure that the Git source used in checkout operations is from a trusted and verified source.
What type of vulnerability is CVE-2026-15793?
CVE-2026-15793 is a command injection vulnerability that can arise from malicious Git source content.
Who is affected by CVE-2026-15793?
CVE-2026-15793 affects users of Docker BuildKit utilizing custom frontends or clients that employ the low-level API.
What actions should be taken if CVE-2026-15793 is exploited?
If CVE-2026-15793 is exploited, immediate measures should include isolating the affected system and evaluating any executed commands.