Threats tagged 'ghsa-fpg8-7664-jc5q'

CVE-2026-54174 is a vulnerability in chainguard.dev/apko where the package manager did not verify the integrity of the data section (actual package files) during installation. While the control section hash was verified against the signed APKINDEX, the data section hash was not, allowing an attacker who can compromise a mirror, cache, or perform a man-in-the-middle attack to substitute arbitrary file contents without detection. This flaw was fixed in versions 1.2.9 and 0.50.4.