Go/github.com/zarf-dev/zarf CVE-2026-40090: high 7.1, EPSS 0.32%

Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Action: Upgrade github.com/zarf-dev/zarf to 0.74.2 or later.

go get github.com/zarf-dev/zarf@v0.74.2

Affected

Fixed versions

Sources

• osv: GHSA-pj97-4p9w-gx3q
• https://github.com/zarf-dev/zarf/security/advisories/GHSA-pj97-4p9w-gx3q
• https://nvd.nist.gov/vuln/detail/CVE-2026-40090
• https://github.com/zarf-dev/zarf/pull/4793
• https://github.com/zarf-dev/zarf

CVE-2026-40090 · published 2026-04-14T22:32:53Z · modified 2026-07-23T17:11:37.884533843Z · JSON