HIGH7.1Go
GHSA-pj97-4p9w-gx3q· CVE-2026-40090, GO-2026-5542Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Modified: 7/23/2026
package
Go/github.com/zarf-dev/zarf
pkg:go/github.com/zarf-dev/zarf
—Go
GO-2026-4636· CVE-2026-29064, GHSA-hcm4-6hpj-vghmZarf's symlink targets in archives are not validated against destination directory in github.com/zarf-dev/zarf
Modified: 3/23/2026
—Go
GO-2026-5542· CVE-2026-40090, GHSA-pj97-4p9w-gx3qPath traversal via malicious package name in github.com/zarf-dev/zarf
Modified: 7/23/2026