This vulnerability in moby BuildKit 0.30.0 arises from improper neutralization of argument delimiters in command construction when using the raw low-level API with git.checkoutbundle=true. If an attacker controls the Git source, they can craft inputs that manipulate command arguments, resulting in command injection on the host system. The CVSS 4.0 base score is 6.5, indicating medium severity with network attack vector, low attack complexity, partial privileges required, user interaction needed, and high impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker controlling a Git source to execute crafted commands on the host running BuildKit 0.30.0, potentially compromising confidentiality, integrity, and availability of the system. The attack requires partial privileges and user interaction but can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a fix is available, avoid using the raw low-level API with git.checkoutbundle=true on untrusted Git sources.