- Severity: MEDIUM
- CVE: CVE-2026-128079
- Ecosystems: pip
- Packages: envd
### Summary
envd’s `install.python_packages(requirements=…)` could read files outside the build context on the host. Content interpreted as dependency entries could appear in build logs and build-step metadata.
Commit f576c92, released in v1.3.5, added path containment validation but left a time-of-check/time-of-use (TOCTOU) race between symlink resolution and opening the requirements file. Commit 9d575b3 addresses this race by opening requirements files through a directory-rooted filesystem handle.
### Details
envd reads requirements files on the host to determine whether their contents can be embedded directly into a pip installation build step.
The vulnerable host-side requirements read was introduced in v0.3.38. Version v1.3.5 added containment checks for static path escapes but remained vulnerable to a TOCTOU race. The complete fix is included in v1.3.6.
Before f576c92, this host read lacked a build-context containment check. That commit added frontend path validation and a compile-time check using filepath.EvalSymlinks followed by a containment comparison.
However, symlink resolution returns a pathname rather than a pinned filesystem object. The subsequent os.Open independently resolves that pathname. Concurrent filesystem changes could therefore invalidate the containment check before the file was opened.
The complete fix uses os.OpenRoot and Root.Open to enforce containment during filesystem traversal.
Resources:
– first commit: be783264fdd79ad7262cea0485b7…
Source: GitHub Security Advisories · 2026-11-13