CVE-2026-33747

{"id": "CVE-2026-33747", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-27T01:16:21.330", "references": [{"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected."}, {"lang": "es", "value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente en artefactos de compilaci\u00f3n de manera eficiente, expresiva y repetible. Antes de la versi\u00f3n 0.28.1, al usar un frontend de BuildKit personalizado, el frontend puede elaborar un mensaje de API que provoca que se escriban archivos fuera del directorio de estado de BuildKit para el contexto de ejecuci\u00f3n. El problema ha sido solucionado en la v0.28.1. La vulnerabilidad requiere usar un frontend de BuildKit no confiable configurado con '#syntax' o '--build-arg BUILDKIT_SYNTAX'. El uso de estas opciones con una imagen de frontend conocida como 'docker/dockerfile' no se ve afectado."}], "lastModified": "2026-04-01T14:34:48.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "393ED789-1B13-4B78-8AFB-290B67EE2A8A", "versionEndExcluding": "0.28.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}