id: GO-2025-3767
modules:
    - module: github.com/google/osv-scalibr
      versions:
        - introduced: 0.1.3
        - fixed: 0.2.1
      vulnerable_at: 0.2.0
summary: |-
    OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via
    Path Traversal in github.com/google/osv-scalibr
cves:
    - CVE-2025-5981
ghsas:
    - GHSA-2hcm-q3f4-fjgw
references:
    - advisory: https://github.com/advisories/GHSA-2hcm-q3f4-fjgw
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-5981
    - fix: https://github.com/google/osv-scalibr/commit/2444419b1818c2d6917fc3394c947fb3276e9d59
    - web: https://github.com/google/osv-scalibr/releases/tag/v0.1.8
source:
    id: GHSA-2hcm-q3f4-fjgw
    created: 2025-07-21T17:03:47.011825465Z
review_status: UNREVIEWED