kapsl Index
Docs Releases

cmake

3 tools · 1 release line

Configure and drive a build from CMakeLists.txt. Every tool here carries the same sandbox boundary.

kapsl cmake
kapsl ctest
kapsl cpack
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description
showing cmake ctest cpack from cmake@latest → 4.2.3 stable

Findings

H13M22L3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66032 ↗ H 8.7 libssh2 libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session.
CVE-2026-66033 ↗ H 8.7 libssh2 libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by…
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-11979 ↗ H 7.8 libxml2 libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.
CVE-2026-66034 ↗ H 7.7 libssh2 libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the…
CVE-2026-66035 ↗ H 7.7 libssh2 libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length…
CVE-2026-14456 ↗ H 7.5 openssl Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-8932 ↗ H 7.5 curl libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
CVE-2026-54370 ↗ H 7.2 acl acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and…
CVE-2026-54369 ↗ H 7.1 acl acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by…
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-13757 ↗ M 6.2 p11-kit A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing…
CVE-2026-18938 ↗ M 6.2 p11-kit A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-76956 ↗ M 5.9 expat In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-76957 ↗ M 4.9 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-16517 ↗ L 2.9 libarchive A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the…
CVE-2025-9301 ↗ L 1.9 cmake A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion.
CVE-2026-75803 ↗ L — openssl CVE-2026-75803

3 further advisories matched this image and were assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex
CVE-2026-42250 bzip2 not affected · vex
CVE-2026-4739 expat not affected · vex

These are the findings of cmake, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default + bash, coreutils, g++, gcc, make, pkg-config
runtime none — self-contained
composes bash, coreutils, g++, gcc, make, pkg-config

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash, coreutils
runtime none — self-contained
composes bash, coreutils

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash, coreutils
runtime none — self-contained
composes bash, coreutils

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

image ghcr.io/kapsl-sh/cmake:4.2.3
digest
platforms
size 80 MB unpacked · 1 layer
base scratch
signed cosign · verified
last scan

Sandbox boundary

cmake

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

7 forwarded

CMAKE_BUILD_PARALLEL_LEVELCMAKE_BUILD_TYPECMAKE_COLOR_DIAGNOSTICSCMAKE_EXPORT_COMPILE_COMMANDSCMAKE_GENERATORCMAKE_INSTALL_PARALLEL_LEVELCMAKE_MAXIMUM_RECURSION_DEPTH

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

ctest

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

4 forwarded

CTEST_NO_TESTS_ACTIONCTEST_OUTPUT_ON_FAILURECTEST_PARALLEL_LEVELCTEST_PROGRESS_OUTPUT

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

cpack

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗ grype ·
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

38 findings across this project at latest. Counted once per advisory across every image the project builds.