PT-2026-32074
Publicado
2026-03-31
·
Atualizado
2026-03-31
Descrição por
CVSS 3.1
7.7
AltaMétricasAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
The jq safe-bin policy blocked explicit
env usage but still allowed jq programs that accessed environment data through $ENV.Impact
An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.
Affected Component
src/infra/exec-safe-bin-semantics.tsFixed Versions
- Affected:
<= 2026.3.24 - Patched:
>= 2026.3.28 - Latest stable
2026.3.28contains the fix.
Fix
Fixed by commit
78e2f3d66d (Exec: tighten jq safe-bin env checks).Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Identificadores relacionados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾