AIKIDO-2026-236579
github.com/moby/buildkit is vulnerable to Argument Injection
62
Medium Risk
This Affects:
github.com/moby/buildkitTL;DR
When checking out Git sources, BuildKit lets custom frontends or raw low-level API clients set git.checkoutbundle=true. A malicious Git source combined with that option produces a crafted command invocation on the host during checkout. This can lead to argument injection and execution of unintended commands. The fix neutralizes the bundle checkout arguments.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you allow untrusted parties to use a custom frontend that checks out Git sources from bundle files.
Background info
github.com/moby/buildkit is vulnerable to Argument Injection in versions 0.30.0 - 0.31.1.
How to fix this
Upgrade the github.com/moby/buildkit library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant