{"action":"Upgrade github.com/tektoncd/pipeline to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"1.0.0"},{"fixed":"1.3.3","introduced":"1.1.0"},{"fixed":"1.6.1","introduced":"1.4.0"},{"fixed":"1.9.2","introduced":"1.7.0"},{"fixed":"1.10.2","introduced":"1.10.0"}],"component":"github.com/tektoncd/pipeline","cve_ids":["CVE-2026-33211"],"ecosystem":"Go","epss":0.00583,"exploited":false,"fixed_versions":["1.0.1","1.3.3","1.6.1","1.9.2","1.10.2"],"ghsa_id":"GHSA-j5q5-j9gm-2w5c","id":"tcs_01M5KFDH7ND6BPE825H1P6GZY3","modified_at":"2026-09-10T03:50:39.821840517Z","published_at":"2026-03-18T20:20:10Z","references":["https://osv.dev/vulnerability/GHSA-j5q5-j9gm-2w5c","https://github.com/tektoncd/pipeline/security/advisories/GHSA-j5q5-j9gm-2w5c","https://nvd.nist.gov/vuln/detail/CVE-2026-33211","https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c","https://github.com/tektoncd/pipeline/commit/318006c4e3a5","https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd","https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae","https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e","https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db","https://github.com/tektoncd/pipeline/commit/ec7755031a183b345cf9e64bea0e0505c1b9cb78","https://github.com/tektoncd/pipeline"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-j5q5-j9gm-2w5c","url":"https://osv.dev/vulnerability/GHSA-j5q5-j9gm-2w5c"}],"summary":"Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod"}