VDB
GO-2026-4359
GO-2026-4359
PUBLISHED
Incus container environment configuration newline injection in github.com/lxc/incus
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | lxc/incus | 0 |
| github.com | lxc/incus/v6 | 6.1.0 |
Timeline
- Feb 5, 2026 CVE Published
- Feb 5, 2026 CVE Updated
- Oct 14, 2026 Security Advisory
References
- https://github.com/lxc/incus/security/advisories/GHSA-x6jc-phwx-hp32 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-23953 advisory
- https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L1081 url
- https://github.com/user-attachments/files/24473682/environment_newline_injection.sh url
- https://github.com/user-attachments/files/24473685/environment_newline_injection.patch url