envd: Host file disclosure through requirements path traversal and TOCTOU
CVE-2026-128079
Summary envd’s install.pythonpackages(requirements=...) could read files outside the build context on the host. Content interpreted as dependency entries could appear in build logs and build-step metadata. Commit f576c92, released in v1.3.5, added path containment validation but left a time-of-check/time-of-use (TOCTOU) race between symlink resolution and opening the requirements file. Commit 9d575b3 addresses this race by opening requirements files through a directory-rooted filesystem handle. Details envd reads requirements files on the host to determine whether their contents can be embedded directly into a pip installation build step. The vulnerable host-side requirements read was introduced in v0.3.38. Version v1.3.5 added containment checks for static path escapes but remained vulnerable to a TOCTOU race. The complete fix is included in v1.3.6. Before f576c92, this host read lacked a build-context containment check. That commit added frontend path validation and a compile-time check using filepath.EvalSymlinks followed by a containment comparison. However, symlink resolution returns a pathname rather than a pinned filesystem object. The subsequent os.Open independently…
Assessment
- CVSS
- 6.8 (v4.0)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 13 November 2026
- Last updated
- 13 November 2026
- Affected
- envd
- Weakness
- CWE-22, CWE-367
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
At the source
References
- https://github.com/tensorchord/envd/security/advisories/GHSA-jv6m-48w5-5rpr
- https://github.com/tensorchord/envd/pull/2112
- https://github.com/tensorchord/envd/pull/2119
- https://github.com/tensorchord/envd/commit/9d575b354ce17a02ef9698b6ff0d5d14296c5734
- https://github.com/tensorchord/envd/commit/f576c92c1e6dcb9b00b60995534aeb2a83b0b407
- https://github.com/tensorchord/envd/releases/tag/v1.3.6
- https://github.com/advisories/GHSA-jv6m-48w5-5rpr
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-128079