{"action":"Upgrade io.spinnaker.rosco:rosco-manifests to 2025.3.4 (2025.3.x), 2025.4.4 (2025.4.x), 2026.0.3 (2026.0.x) or 2026.1.1 (2026.1.x) or later.","affected":[{"fixed":"2025.3.4","introduced":"0"},{"fixed":"2025.4.4","introduced":"2025.4.0"},{"fixed":"2026.0.3","introduced":"2026.0.0"},{"fixed":"2026.1.1","introduced":"2026.1.0"}],"component":"io.spinnaker.rosco:rosco-manifests","cve_ids":["CVE-2026-55175"],"ecosystem":"Maven","epss":0.01057,"exploited":false,"fixed_versions":["2025.3.4","2025.4.4","2026.0.3","2026.1.1"],"ghsa_id":"GHSA-p68j-q7hf-3qcp","id":"tcs_01M5N96N6VH1F3BVHBWJK40Q28","modified_at":"2026-09-10T03:51:14.688449229Z","published_at":"2026-08-28T18:35:06Z","references":["https://osv.dev/vulnerability/GHSA-p68j-q7hf-3qcp","https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp","https://nvd.nist.gov/vuln/detail/CVE-2026-55175","https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe","https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7","https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009","https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd","https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f","https://github.com/spinnaker/spinnaker","https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4","https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4","https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3","https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1","https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p68j-q7hf-3qcp","url":"https://osv.dev/vulnerability/GHSA-p68j-q7hf-3qcp"}],"summary":"Spinnaker: Improper yaml processing on kustomize bake operations"}