{"action":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 or later.","affected":[{"fixed":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","introduced":"0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2026-85057"],"ecosystem":"Go","epss":0.0039,"exploited":false,"fixed_versions":["1.80.0-v2.20.0.20260717062331-baf6ed501b68"],"ghsa_id":"GHSA-fgmf-7rf8-m6vf","id":"tcs_01M5KF95NXNX2RT3D3EFEWA6B6","modified_at":"2026-10-01T20:56:14.597424590Z","published_at":"2026-09-24T18:19:32Z","references":["https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v3.4.13","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-fgmf-7rf8-m6vf","url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf"}],"summary":"ZITADEL: Actions V1 sandbox escape: host file read via require()"}