smolvm

v1.3.8 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 24d Virtualization

✓ No known CVEs patched

This release patches 1 known CVE

Topics

containers crun libkrun microvm rust virtual-machine

Affected surfaces

rce_ssrf

Summary

AI summary

Fixes prevent OOM from streaming exec output and block symlink-parent host-escape during tar extraction.

Full changelog

fix(exec): bound streaming exec output to prevent host OOM; reach aarch64 seccomp call site by @BinSquare in https://github.com/smol-machines/smolvm/pull/529
fix(pack): block symlink-parent host-escape in sparse tar extraction by @BinSquare in https://github.com/smol-machines/smolvm/pull/530
Kill a wedged VM identified by its unique boot-config argv so teardown never leaks an untracked live orphan by @BinSquare in https://github.com/smol-machines/smolvm/pull/532
Bump the workspace to 1.3.8 by @BinSquare in https://github.com/smol-machines/smolvm/pull/533

Full Changelog: https://github.com/smol-machines/smolvm/compare/v1.3.7...v1.3.8

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track smolvm

Get notified when new releases ship.

About smolvm

Tool to build & run portable, lightweight, self-contained virtual machines.