buildkit

v0.31.2 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 10d Build & Package

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 5 known CVEs

Topics

builder buildkit cloud-native containers docker go

+1 more

oci-image

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 10d

The v0.31.2 release of BuildKit patches several security flaws affecting Git source checkouts, frontend parameter handling, LLB file operations, and local source uploads.

Why it matters: Fixes command‑injection risk in Git bundle checkouts (severity 70) and blocks directory‑traversal bypass on local source uploads; mitigations are critical for any deployment using these surfaces.

Summary

AI summary

Updates Notable Changes, Dependency Changes, and https://github.com/moby/buildkit/releases/tag/v0.31.1 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	High	Fixes command injection vulnerability in Git source checkout from bundle file. Fixes command injection vulnerability in Git source checkout from bundle file. Source: llm_adapter@2026-07-16 Confidence: high	—
Security	High	Prevents possible panic from incorrect frontend parameters. Prevents possible panic from incorrect frontend parameters. Source: llm_adapter@2026-07-16 Confidence: high	—
Security	High	Prevents LLB file operation from removing /tmp directory contents. Prevents LLB file operation from removing /tmp directory contents. Source: llm_adapter@2026-07-16 Confidence: high	—
Security	High	Blocks malicious clients from bypassing destination directory validation on local source uploads. Blocks malicious clients from bypassing destination directory validation on local source uploads. Source: llm_adapter@2026-07-16 Confidence: high	—
Security	Medium	Prevents WCOW cache mount source selector from resolving NTFS junctions outside cache root. Prevents WCOW cache mount source selector from resolving NTFS junctions outside cache root. Source: llm_adapter@2026-07-16 Confidence: high	—
Dependency	Low	Updates github.com/tonistiigi/fsutil from 0257b3308df4 to 30cd4fc5d911. Updates github.com/tonistiigi/fsutil from 0257b3308df4 to 30cd4fc5d911. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Fixes possible buildctl failures after successful builds over slow connhelper transports. Fixes possible buildctl failures after successful builds over slow connhelper transports. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Prevents daemon crash during concurrent builds. Prevents daemon crash during concurrent builds. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

Welcome to the v0.31.2 release of buildkit!

This is a security patch release with four moderate and one low severity security fixes.

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

Tõnis Tiigi
CrazyMax
Dawei Wei

Notable Changes

Git source checkout from a bundle file could lead to command injection. https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv
Possible panic when incorrect parameters sent from frontend. https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6
LLB file operation can be tricked to remove /tmp directory contents. https://github.com/moby/buildkit/security/advisories/GHSA-32pv-7hq5-qhwq
Malicious client can bypass destination directory validation on local sources upload. https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976
WCOW cache mount source selector resolves NTFS junctions outside of cache root. https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2
Fix possible buildctl failures after successful builds over slow connhelper transports. #6940
Fix possible daemon crash during concurrent builds. #6916

Dependency Changes

github.com/tonistiigi/fsutil 0257b3308df4 -> 30cd4fc5d911

Previous release can be found at v0.31.1

Security Fixes

GHSA-hw3h-2gp9-cxpv — Git source checkout from a bundle file could lead to command injection (moderate severity)
GHSA-qx3x-mv6r-52p6 — Possible panic when incorrect parameters sent from frontend (moderate severity)
GHSA-32pv-7hq5-qhwq — LLB file operation can be tricked to remove `/tmp` directory contents (moderate severity)
GHSA-g2h8-426c-7976 — Malicious client can bypass destination directory validation on local sources upload (moderate severity)
GHSA-388v-wmr2-g2v2 — WCOW cache mount source selector resolves NTFS junctions outside of cache root (low severity)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track buildkit

Get notified when new releases ship.

About buildkit

concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit

All releases →