Threats affecting pkg:github/apple/container

CVE-2026-113957 is a vulnerability in Apple's container and containerization products where an attacker controlling the registry, a mirror, or the network path can serve arbitrary image content during a pull by digest. This could cause users to run images different from those they intended to pin. The vulnerability is fixed in container version 1.6.0 and containerization version 0.52.1 by verifying the returned digest against the pinned digest and validating the hash of manifests and blobs. Tag pulls remain exempt due to their mutable nature.

CVE-2026-113951 is a vulnerability in Apple's Container product prior to version 1.5.0. It allows an attacker with write access to the filesystem of a Kubernetes cluster container to plant an exec credential plugin in the cluster's admin.conf file. When the kubeconfig is pulled onto a macOS host and kubectl is run, the malicious plugin executes with the host user's privileges, enabling arbitrary command execution on the host. This vulnerability is fixed in Container version 1.5.0.

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.

CVE-2026-28909 is a vulnerability in Apple macOS where users connecting to malicious registries with hostnames that match certain bypass patterns may have their registry credentials exposed in plaintext. This issue affects container version 0.12.1 and is fixed in version 0.12.3. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There are no known exploits in the wild at this time.

CVE-2026-20613 is a high-severity vulnerability in Apple's Container product affecting the ArchiveReader.extractContents() function used by cctl image load and container image load. The function fails to validate pathnames before extracting archive members, allowing maliciously crafted archives to write files to arbitrary user-writable locations via relative pathnames. This can lead to full compromise of confidentiality, integrity, and availability of affected systems. Exploitation requires local access and user interaction but no privileges. The issue is addressed in container 0.8.0 and containerization 0.21.0.