Argument injection in BuildKit Git source checkout via bundle file (CVE-2026-15793)

BuildKit custom frontends or clients using the raw low-level API can enable `git.checkoutbundle=true` when checking out Git sources. A malicious Git source can exploit this to cause a crafted command invocation on the host. Standard Dockerfile builds are not affected; the vulnerability requires use of a custom frontend together with a malicious Git source. Affected versions: - v0.30.0 - v0.31.1 We recommend updating to: v0.31.2+. CVSS 7.3 · our assessment: this_week Reference: https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv Details: https://vuln.today/cve/CVE-2026-15793