Go/github.com/edgelesssys/contrast CVE-2026-100839: high 8.4, EPSS 0.15%
Contrast BadAML injection allows arbitrary code execution
Action: Upgrade github.com/edgelesssys/contrast to 1.18.0 or later.
go get github.com/edgelesssys/contrast@v1.18.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.18.0 | - |
Fixed versions
| 1.18.0 |
Sources
- osv: GHSA-g9ww-x58f-9g6m
- https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m
- https://blackhat.com/eu-24/briefings/schedule/#aml-injection-attacks-on-confidential-vms-42723
- https://dl.acm.org/doi/pdf/10.1145/3719027.3765123
- https://github.com/edgelesssys/contrast
CVE-2026-100839 · published · modified · JSON