{"id":"CVE-2024-23652","aliases":["GHSA-4v98-7qmw-rqr8","GO-2024-2494"],"title":"BuildKit vulnerable to possible host system access from mount stub cleaner","summary":"BuildKit vulnerable to possible host system access from mount stub cleaner","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","vendor":"moby","product":"github.com/moby/buildkit","ecosystem":"go","affected":["github.com/moby/buildkit < 0.12.5"],"patched":["github.com/moby/buildkit 0.12.5"],"published":"2024-01-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:04.779734057Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4v98-7qmw-rqr8","references":[{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23652"},{"url":"https://github.com/moby/buildkit/pull/4603"},{"url":"https://github.com/moby/buildkit"},{"url":"https://github.com/moby/buildkit/releases/tag/v0.12.5"}],"tags":["osv","go","exploit-available"],"epss":0.02055,"epssPercentile":0.80169,"exploits":{"github":1,"githubRepos":["https://github.com/abian2/CVE-2024-23652"],"checkedAt":"2026-09-21T15:26:21.394Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.753Z","slug":"CVE-2024-23652","body":"## Overview\n\n### Impact\nA malicious BuildKit frontend or Dockerfile using `RUN --mount` could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.\n\n### Patches\nThe issue has been fixed in v0.12.5\n\n### Workarounds\nAvoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing `RUN --mount` feature.\n\n### References\n\n\n\n## Affected packages\n\n- `github.com/moby/buildkit < 0.12.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/moby/buildkit 0.12.5`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[]}