google/osv-scalibr

google/osv-scalibr

security.googleblog.com

Releases24

Frequency4 weeks 1 day

Last Release 3 months ago

Stars606

OSV-SCALIBR: A library for Software Composition Analysis

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-13425 ↗	Nov 20, 2025Thursday, 20 November 2025, 16:15	—	—
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
CVE-2025-5981 ↗	Jun 18, 2025Wednesday, 18 June 2025, 09:15	6.5 MEDIUM	—
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.