{"action":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 or later.","affected":[{"fixed":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","introduced":"0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2026-85057"],"ecosystem":"Go","epss":0.0039,"exploited":false,"fixed_versions":["1.80.0-v2.20.0.20260717062331-baf6ed501b68"],"ghsa_id":"GHSA-fgmf-7rf8-m6vf","id":"tcs_01M5KGVNAEADJKXDGBDPX7YG6K","modified_at":"2026-10-01T20:45:15.078272798Z","published_at":"2026-10-01T20:23:38Z","references":["https://osv.dev/vulnerability/GO-2026-6591","https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","https://github.com/zitadel/zitadel/releases/tag/v3.4.13","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GO-2026-6591","url":"https://osv.dev/vulnerability/GO-2026-6591"},{"source":"nvd","source_id":"CVE-2026-85057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85057"}],"summary":"ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel"}