SNYK-GOLANG-GITHUBCOMMOBYBUILDKITEXECUTOROCI-6209338

## Overview Affected versions of this package are vulnerable to Race Condition (Leaky Vessels) in the subpath mounting when two malicious build steps are running in parallel and sharing the same cache mounts. This can lead to files from the host system being accessible to the build container. ## Workaround Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with `--mount=type=cache,source=...` options. *This vulnerability was discovered and responsibly disclosed as part of the [Leaky Vessels](https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/) project.* ## Remediation Upgrade `github.com/moby/buildkit/executor/oci` to version 0.12.5 or higher. ## References - [GitHub Commit](https://github.com/moby/buildkit/commit/f781267af1acb688e94740e1fdc22c1bf587d7fd) - [OSS Security List](https://www.openwall.com/lists/oss-security/2019/05/28/1) - [Snyk Blog Post](https://snyk.io/blog/cve-2024-23651-docker-buildkit-mount-cache-race-build-time-race-condition-container-breakout/)