Threats affecting pkg:github/gvisor-tap-vsock

CVE-2026-107935 is a critical path traversal vulnerability in gvproxy, part of the gvisor-tap-vsock package used by Red Hat Build of Podman Desktop. The vulnerability exists in the unauthenticated /services/forwarder/expose endpoint, which fails to validate the caller-supplied socket path. This flaw allows an attacker to delete arbitrary files on the host system. The issue affects versions from 0.4.0 up to but not including 0.9.0. The vulnerability has a CVSS 3.1 score of 9.3, indicating high impact on integrity and availability without requiring privileges or user interaction.