| id: GO-2026-6312 |
| modules: |
| - module: github.com/oam-dev/kubevela |
| versions: |
| - fixed: 1.9.14 |
| - introduced: 1.10.0-alpha.1 |
| - fixed: 1.10.9 |
| - introduced: 1.11.0-alpha.1 |
| - fixed: 1.11.0-alpha.4 |
| vulnerable_at: 1.11.0-alpha.3 |
| summary: KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela |
| cves: |
| - CVE-2026-55108 |
| ghsas: |
| - GHSA-fmgp-q6jx-gg3x |
| references: |
| - advisory: https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x |
| - web: https://github.com/kubevela/kubevela/commit/65dedda40a69cc1eccf4072a4c835e5b9f13334e |
| - web: https://github.com/kubevela/kubevela/commit/7a4e59b2958ce1cf031fafbc188d6fafe8fe4d2e |
| - web: https://github.com/kubevela/kubevela/commit/f6a64398b5e0065c57c3a0fb6765dd3dc48c749d |
| - web: https://github.com/kubevela/kubevela/pull/7191 |
| - web: https://github.com/kubevela/kubevela/pull/7192 |
| - web: https://github.com/kubevela/kubevela/releases/tag/v1.10.9 |
| - web: https://github.com/kubevela/kubevela/releases/tag/v1.11.0-alpha.4 |
| - web: https://github.com/kubevela/kubevela/releases/tag/v1.9.14 |
| source: |
| id: GHSA-fmgp-q6jx-gg3x |
| created: 2026-09-01T13:19:53.612221-04:00 |
| review_status: UNREVIEWED |
