{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"lxd","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NT9HZRE8MBC5NX8SYECZA9","modified_at":"2026-10-25T09:47:36.425874487Z","published_at":"2026-08-12T20:17:47.060Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-63293","https://security-tracker.debian.org/tracker/CVE-2026-63293"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-63293#Debian:13/lxd","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-63293"}],"summary":"A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whe"}