VULNERABILITY INTELLIGENCE

CVE-2026-15793

CVSS score7.5 HIGH

EPSS probability0.20%

CISA KEVNot currently listed

Published2026-07-21

Last modified2026-10-24

Description

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.