{"items":[{"id":"NVI-00016289","kind":"vulnerability","title":"runc vulnerable to container breakout through process.cwd trickery and leaked fds","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xr7r-f8xq-vfvv","CVE-2024-21626"],"plain_summary":"GitHub lists this reviewed advisory for github.com/opencontainers/runc. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6167adf9664bdf30c11438507e14d56b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-21T14:42:33.000Z","value":"8.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6167adf9664bdf30c11438507e14d56b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6167adf9664bdf30c11438507e14d56b","url":"https://github.com/advisories/GHSA-xr7r-f8xq-vfvv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xr7r-f8xq-vfvv","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:49.300Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6167adf9664bdf30c11438507e14d56b"],"technology":"github.com/opencontainers/runc","known_exclusions":[],"conditions_summary":"### Impact\n\nIn runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from `runc exec`) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem (\"attack 2\"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through `runc run` (\"attack 1\"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes (\"attack 3a\" and \"attack 3b\").\n\nStrictly speaking, while attack 3a is the most severe from a CVSS perspective, attacks 2 and 3b are arguably more dangerous in practice because they allow for a breakout from inside a container as opposed to requiring a user execute a malicious image. The reason attacks 1 and 3a are scored higher is because being able to socially engineer users is treated as a given for UI:R vectors, despite attacks 2 and 3b requiring far more minimal user interaction (just reasonable `runc exec` operations on a container the attacker has access to). In any case, all four attacks can lead","public_affected_ranges":[">= 1.0.0-rc93, <= 1.1.11"]}],"null_published_at":"2026-11-04T10:04:27.928Z","source_updated_at":"2026-07-21T14:42:33.000Z","source_disclosed_at":"2024-01-31T22:44:08.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:34:49.300Z"}],"next_cursor":null,"snapshot_revision":"42594"}