BuildKit: Malicious client can bypass destination directory validation on local sources upload
CVE-2026-75593 is fixed in runfinch-finch on 1 platform by ALAS2023-2026-3140 (version 1.19.0-1.amzn2023.0.1), released September 28, 2026. It is not reported as exploited. Patch Radar priority: High.
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| runfinch-finch · amzn 2023 | 1.19.0-1.amzn2023.0.1 | ALAS2023-2026-3140 | Sep 28, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.