—
GO-2026-6312
KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela
Quick fix
GO-2026-6312 — github.com/oam-dev/kubevela: upgrade to the fixed version with the command below.
go get github.com/oam-dev/kubevela@v1.9.14Details
KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/oam-dev/kubevela
Introduced in:
0Fixed in: 1.9.14Fix
go get github.com/oam-dev/kubevela@v1.9.14References
- https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x[ADVISORY]
- https://github.com/kubevela/kubevela/commit/65dedda40a69cc1eccf4072a4c835e5b9f13334e[WEB]
- https://github.com/kubevela/kubevela/commit/7a4e59b2958ce1cf031fafbc188d6fafe8fe4d2e[WEB]
- https://github.com/kubevela/kubevela/commit/f6a64398b5e0065c57c3a0fb6765dd3dc48c749d[WEB]
- https://github.com/kubevela/kubevela/pull/7191[WEB]
- https://github.com/kubevela/kubevela/pull/7192[WEB]
- https://github.com/kubevela/kubevela/releases/tag/v1.10.9[WEB]
- https://github.com/kubevela/kubevela/releases/tag/v1.11.0-alpha.4[WEB]
- https://github.com/kubevela/kubevela/releases/tag/v1.9.14[WEB]