Apache BuildStream EUVD-2026-85113

Requires the tar source plugin of BuildStream to fetch an attacker-controlled or untrusted source tarball containing symlinks that escape the extraction directory, AND the host must run Python < 3.12 (Python >= 3.12 with BuildStream >= 2.3.0 applies the tarfile extraction filter that blocks the escape). Exploitation is limited by: the victim must build/fetch an untrusted project (trusted-source-only projects are not affected), SHA256 hash pinning on already-tracked sources prevents MITM substitution, and impact is bounded to the privileges of the user running BuildStream. Not exploitable against default use of trusted, tracked sources.

The published CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which paints this as a wormable, no-interaction, unauthenticated remote compromise. That rating is misleading when cross-referenced against the other signals. EPSS is only 0.19% (10th percentile) and CISA's SSVC decision is Exploitation=none, Automatable=yes, Technical Impact=total - i.e. no observed or public exploitation despite the high technical impact. There is no CISA KEV listing and no public POC. Critically, the description itself lists mitigations that contradict the PR:N/UI:N framing: exploitation requires the victim to fetch/build a BuildStream project that references a malicious or attacker-controlled source tarball, and it only works on Python < 3.12 (Python >= 3.12 with BuildStream >= 2.3.0 uses the tarfile extraction filter that blocks the symlink escape). SHA256 pinning on tracked sources further blocks MITM tampering of already-tracked projects. In practice this is a supply-chain / trusted-input problem gated on user action (building an untrusted project) and a specific interpreter version, not an internet-facing remote hole - real-world priority is LOW-to-MODERATE for organizations that build untrusted BuildStream projects on Python < 3.12, despite the 9.8 label.

An attacker publishes or tampers with a source tarball referenced by a BuildStream element's tar source plugin, embedding symlinks that point outside the extraction directory. When a developer or CI system fetches/builds that project on Python < 3.12, extraction follows the symlinks and writes attacker-controlled files anywhere the BuildStream user can write, enabling code execution or config tampering as that user. No public exploit code has been identified at time of analysis.