envd versions from 0.3.38 up to but not including 1.3.6 have a vulnerability in the install.python_packages(requirements=...) function that allows reading files outside the intended build context on the host. This occurs due to a time-of-check/time-of-use (TOCTOU) race condition between symlink resolution and file opening, which was partially fixed in v1.3.5 but fully resolved in v1.3.6. An attacker able to influence build inputs and concurrently modify filesystem paths may cause envd to disclose host files within the permissions of the envd process. The vulnerability may expose information through dependency debug logs and build-step metadata but does not allow arbitrary code execution or full file disclosure.