Severity by source
Network vector because image is fetched from remote registry; UI:R because an operator must pull and run the image; scope change because container boundary is broken to affect the host.
Lifecycle Timeline
1DescriptionCVE.org
[GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection]
AnalysisAI
Arbitrary host filesystem write is achievable via two distinct attack paths in an OCI image-handling component: symlinks planted inside OCI image layers that resolve outside the container root during image extraction, and newline characters injected into oci.dns.* annotation values that corrupt host-side configuration files written from those annotations. Both paths allow an attacker who controls an OCI image to write attacker-controlled data to arbitrary paths on the host system, breaking container isolation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a target system pull and instantiate an attacker-controlled OCI image using the affected runtime. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS metrics are absent from the source record, so severity must be inferred entirely from the vulnerability description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the GHSA advisory at https://github.com/advisories/GHSA-7fj9-65v4-rp7h for the canonical fix version - no exact patched release version is available from the current source record. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today