Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33748 / GHSA-4vrq-3vrq-g6gg BuildKit Git context validation bug: malformed Git URL#ref:subdir input could reach files outside the checked-out repo root, though access is limited to the same mounted filesystem. Relevant if you build from untrusted Git URLs.
Post summary
BuildKit vulnerability allows file access outside the repository root when using malformed Git URLs, affecting builds from untrusted Git sources.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mobyproject | buildkit | - | - | - |