{"action":"Upgrade github.com/aquaproj/aqua/v2 to 2.60.1 or later.","affected":[{"fixed":"2.60.1","introduced":"0"}],"component":"github.com/aquaproj/aqua/v2","cve_ids":["CVE-2026-55569"],"ecosystem":"Go","epss":0.00181,"exploited":false,"fixed_versions":["2.60.1"],"ghsa_id":"GHSA-mf5c-hw34-4hpp","id":"tcs_01M5KFFS5T3TZT82S9R910E52X","modified_at":"2026-09-02T19:55:33.283638991Z","published_at":"2026-08-28T16:27:08Z","references":["https://osv.dev/vulnerability/GHSA-mf5c-hw34-4hpp","https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp","https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a","https://github.com/aquaproj/aqua","https://github.com/aquaproj/aqua/releases/tag/v2.60.1"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GHSA-mf5c-hw34-4hpp","url":"https://osv.dev/vulnerability/GHSA-mf5c-hw34-4hpp"}],"summary":"Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory"}