{"id":"CVE-2026-93325","published":"2026-11-03T20:18:19.680","lastModified":"2026-11-03T20:30:24.880","description":"Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-693"],"vendors":[],"products":[],"references":[{"url":"https://github.com/docker/buildx/releases/tag/v0.37.2","tags":[]},{"url":"https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682","tags":[]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-CAN-31688/","tags":[]}],"exploitRefs":[{"url":"https://github.com/docker/buildx/releases/tag/v0.37.2","tags":[]},{"url":"https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682","tags":[]}],"hasPoc":true,"ai":null}