github.com/zarf-dev/zarf vulnerabilities (Go)

2 vulnerabilities.

• github.com/zarf-dev/zarf Go Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write CVE-2026-40090 Fix available 7.1 HighApril 14, 2026
• github.com/zarf-dev/zarf Go Zarf: Symlink targets in archives are not validated against destination directory CVE-2026-29064 Fix available 8.2 HighMarch 6, 2026