Go/github.com/aquaproj/aqua/v2 CVE-2026-55569: medium 6.6, EPSS 0.18%
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
Action: Upgrade github.com/aquaproj/aqua/v2 to 2.60.1 or later.
go get github.com/aquaproj/aqua/v2@v2.60.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.60.1 | - |
Fixed versions
| 2.60.1 |
Sources
- osv: GHSA-mf5c-hw34-4hpp
- https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp
- https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a
- https://github.com/aquaproj/aqua
- https://github.com/aquaproj/aqua/releases/tag/v2.60.1
CVE-2026-55569 · published · modified · JSON