github.com/sylabs/singularity

11 results · Feed

• Medium 4.8
  CVE-2026-47215

  Singularity: Incorrect path matching for 'limit container paths' directive

  SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling dire…

  sylabs singularity SingularityPRO singularity-container Ubuntu Alpine Go
  Sep 15, 2026
• Medium 4.5
  CVE-2025-64750

  Singluarity ineffectively applies of selinux / apparmor LSM process labels

  SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can red…

  sylabs singularity singularity-container singularity Ubuntu Alpine Go
  Dec 2, 2025
• Medium 6.3
  CVE-2021-32635

  Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

  Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the conta…

  sylabs singularity singularity-container singularity Ubuntu Alpine Go
  May 28, 2021
• High 8.2
  CVE-2020-15229

  Path traversal and files overwrite with unsquashfs

  Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host fi…

  hpcng singularity singularity github.com/sylabs/singularity Alpine Go
  Oct 14, 2020
• High 8.8
  CVE-2020-25040

  Insecure permissions on build temporary rootfs in Singularity

  Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 8.1
  CVE-2020-25039

  Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity

  Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 7.5
  CVE-2020-13846

  "Verify All" Returns Success Despite Validation Failures in Singularity

  Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2020-13845

  Execution Control List (ECL) Is Insecure in Singularity

  Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file…

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2019-19724

  Singularity insecure permissions

  Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

  singularity github.com/sylabs/singularity Alpine Go
  Dec 18, 2019
• High 8.8
  CVE-2019-11328

  Incorrect Permission Assignment for Critical Resource in Singularity

  An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/s…

  github.com/sylabs/singularity Go
  May 14, 2019
• High 7.8
  CVE-2018-19295

  Sylabs Singularity Improper Input Validation

  Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.

  singularity-container github.com/sylabs/singularity Ubuntu Go
  Dec 17, 2018