Go/github.com/aquaproj/aqua CVE-2026-55569: medium 6.6, EPSS 0.18%
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-6314
- nvd: CVE-2026-55569
- https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp
- https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a
- https://github.com/aquaproj/aqua/releases/tag/v2.60.1
CVE-2026-55569 · published · modified · JSON