Zarf-dev Zarf vulnerabilities

• lfprojects zarf Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write CVE-2026-40090 Fix available 7.1 HighApril 14, 2026
• lfprojects zarf Zarf: Symlink targets in archives are not validated against destination directory CVE-2026-29064 Fix available 8.2 HighMarch 6, 2026