{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/canonical/lxd","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3g2j-vm47-x4mj","id":"tcs_01M5KGBKKGJZ9XPS847ZN9W6ZP","modified_at":"2025-11-18T16:14:17.916056Z","published_at":"2025-11-18T15:44:15Z","references":["https://osv.dev/vulnerability/GO-2025-4121","https://github.com/canonical/lxd/security/advisories/GHSA-3g2j-vm47-x4mj","https://github.com/canonical/lxd/pull/16904","https://github.com/canonical/lxd/pull/16922","https://github.com/canonical/lxd/pull/16923","https://github.com/canonical/lxd/pull/16924","https://github.com/lxc/incus/issues/2641","https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2025-4121","url":"https://osv.dev/vulnerability/GO-2025-4121"}],"summary":"LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd"}