apko has a path traversal in apko dirFS which allows filesystem writes outside base
Modified: 9/10/2026
package
pkg:go/chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base
Modified: 9/10/2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
Modified: 9/10/2026
melange: Incomplete package integrity verification allows data section substitution
Modified: 9/10/2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
Modified: 9/10/2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Modified: 9/10/2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Modified: 9/10/2026
apko Exposure of HTTP basic auth credentials in log output
Modified: 9/10/2026
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
Modified: 9/10/2026
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
Modified: 2/4/2026
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
Modified: 2/4/2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
Modified: 2/6/2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko
Modified: 2/6/2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko
Modified: 3/18/2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
Modified: 7/22/2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
Modified: 7/22/2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
Modified: 6/25/2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Modified: 7/22/2026