Recommended action

Update go.qbee.io/transport to 1.26.25 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination) affects go.qbee.io/transport (go). Severity is medium. ### Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination. ### Patches The issue has been addressed in version v1.26.25

AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update go.qbee.io/transport to 1.26.25 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination) affects go.qbee.io/transport (go). Severity is medium. ### Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination. ### Patches The issue has been addressed in version v1.26.25

AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software