Threats affecting pkg:golang/github.com/ctfer-io/romeo

CVE-2026-32805 is a high-severity path traversal vulnerability in the ctfer-io romeo tool versions prior to 0.2.2. The flaw exists in the sanitizeArchivePath function, which incorrectly validates archive paths due to a missing trailing path separator check. This allows a crafted tar archive to write files outside the intended extraction directory, potentially overwriting critical files or placing malicious files on the system. The vulnerability requires no authentication or user interaction and can be exploited remotely if an attacker can supply a malicious archive. The issue affects Go applications using romeo for code coverage measurement in GitHub Actions workflows. Version 0.2.2 of romeo fixes this vulnerability.

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod out of it. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. Removing the `inter-ns` NetworkPolicy patches the vulnerability in version 0.2.1. If updates are not possible in production environments, manually delete `inter-ns` and update as soon as possible. Given one's context, delete the failing network policy that should be prefixed by `inter-ns-` in the target namespace.