VDB

GHSA-cgrx-mc8f-2prm

GHSA-cgrx-mc8f-2prm PUBLISHED CVSS 7.300000190734863 HIGH

Record from GitHub Advisory Database · Published November 5, 2025

github.com/opencontainers/runc is fixed in 1.4.0-rc.3, 1.3.3 and 1.2.8 (Go Modules)

runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/opencontainers/runcGo Modules1.4.0-rc.3, 1.3.3, 1.2.8
kubernetes-1.30Wolfi1.30.14-r8
neuvectorChainguard5.4.7-r1
kubernetes-1.34Chainguard1.34.1-r3
eks-distro-1.34Chainguard1.34.9-r1
mesosphere-vsphere-csiWolfi3.5.0-r4
kubernetes-csi-driver-nfsChainguard4.12.1-r2
prometheus-podman-exporterWolfi1.19.0-r3
syftChainguard1.37.0-r1
prometheus-node-exporterWolfi1.10.2-r1
chainctlChainguard0.2.174-r0
kubernetes-csi-driver-nfsWolfi4.12.1-r2

87 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
7.300000190734863
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected products

VendorProductVersions
wolfikubernetes-1.300
chainguardneuvector0
chainguardkubernetes-1.340
chainguardeks-distro-1.340
wolfimesosphere-vsphere-csi0
chainguardkubernetes-csi-driver-nfs0
wolfiprometheus-podman-exporter0
chainguardsyft0
wolfiprometheus-node-exporter0
chainguardchainctl0
github.comopencontainers/runc1.3.0-rc.1, 0, 1.4.0-rc.1
wolfikubernetes-csi-driver-nfs0
chainguardamazon-k8s-cni-fips0
chainguardosv-scanner0
chainguardk8s-device-plugin0
chainguardundock0
wolfik3s-1.320
chainguardk3s-1.310
chainguardkubernetes-csi-driver-nfs-fips0
chainguardblob-csi-1.260

…and 175 more

Timeline

  • Nov 5, 2025 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-cgrx-mc8f-2prm
vulnetix vdb fixes GHSA-cgrx-mc8f-2prm

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-cgrx-mc8f-2prm/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 10 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›