VDB
CVE-2026-57825
CVE-2026-57825
PUBLISHED
CVSS 5.7 MEDIUM
Reported by mitre · Published September 9, 2026
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
Risk Scores
CVSS 3.1
5.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OCaml | opam | 0 |
| OCaml | opam | 0, 0 |
| alpine | opam | 0, 0, 0 |
Timeline
- Jul 7, 2026 CVE Published
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
- Oct 11, 2026 EPSS Score