GHSA lookup

GHSA-QQ3R-W4HJ-GJP6

Pruva has a verified reproduction for GHSA-QQ3R-W4HJ-GJP6: apko: symlink-following path traversal writes files outside the build root. The canonical evidence record is REPRO-2026-00152.

REPRO

REPRO-2026-00152

Package

apko · go

Severity

HIGH

Status

published

Open verified reproduction Plain text for agents GitHub advisory