Go/github.com/lxc/incus/v6 CVE-2026-23953: high 8.7, EPSS 0.49%

Incus container environment configuration newline injection

Action: Upgrade github.com/lxc/incus/v6 to 6.21.0 or later.

go get github.com/lxc/incus/v6@v6.21.0

Affected

Fixed versions

Sources

• osv: GHSA-x6jc-phwx-hp32
• https://github.com/lxc/incus/security/advisories/GHSA-x6jc-phwx-hp32
• https://nvd.nist.gov/vuln/detail/CVE-2026-23953
• https://github.com/lxc/incus
• https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L1081
• https://github.com/user-attachments/files/24473682/environment_newline_injection.sh
• https://github.com/user-attachments/files/24473685/environment_newline_injection.patch

CVE-2026-23953 · published 2026-01-22T20:21:17Z · modified 2026-03-27T22:34:09.180340Z · JSON