Skip to content
OpenAdvisories

Package · Go

github.com/aquaproj/aqua

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 6.6
    CVE-2026-55569

    aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

    aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction des…

    aquaproj aqua github.com/aquaproj/aqua github.com/aquaproj/aqua/v2 Go