What’s Vulnerable › Products

zarf-dev zarf vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your zarf-dev zarf version is affected

Latest zarf-dev zarf vulnerabilities

• CVE-2026-40090 — Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write (CVSS 7.1)
• CVE-2026-29064 — Zarf: Symlink targets in archives are not validated against destination directory (CVSS 8.2)