OSV-SCALIBR Path Traversal Vulnerability Leading to Arbitrary File Write

A path traversal vulnerability has been identified in OSV-SCALIBR, specifically in the unpacking code for container images. This vulnerability allows for arbitrary file writing on the host system as the OSV-SCALIBR user. The issue arises when the CLI flag --remote-image is used with untrusted container images.

Impact

Exploitation of this vulnerability allows for arbitrary file writing on the host system, which could potentially lead to overwriting critical system files or creating files in sensitive locations.

Remediation

Users can update to OSV-SCALIBR version 0.1.8, which addresses this vulnerability. The updated version is available on the GitHub Releases page for the OSV-SCALIBR repository.