Threats affecting pkg:github/apple/containerization

CVE-2026-113957 is a vulnerability in Apple's container and containerization products where an attacker controlling the registry, a mirror, or the network path can serve arbitrary image content during a pull by digest. This could cause users to run images different from those they intended to pin. The vulnerability is fixed in container version 1.6.0 and containerization version 0.52.1 by verifying the returned digest against the pinned digest and validating the hash of manifests and blobs. Tag pulls remain exempt due to their mutable nature.

CVE-2026-65388 is a vulnerability in Apple's containerization software that allows a remote attacker controlling a container registry to redirect a client's token request to an attacker-chosen host, potentially exposing the victim's registry credentials. This issue affects versions prior to 0.41.0 and has been addressed in version 0.41.0.