{"cve":"CVE-2024-24579","nvd":{"published":"2024-01-31T17:15:40.170","modified":"2026-06-17T07:14:38.890","status":"Modified","description":"stereoscope is a go library for processing container images and simulating a squash filesystem.  Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of `github.com/anchore/stereoscope/pkg/file.UntarToDirectory()` function, the  `github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider` struct, or the higher level `github.com/anchore/stereoscope/pkg/image.Image.Read()` function express this vulnerability. As a workaround, if you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-22"],"references":["https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204","https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv","https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204","https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv"],"products":["anchore:stereoscope"],"source":"nvd","synced_at":"2026-10-19T21:44:57.175229480+00:00"},"epss":{"cve":"CVE-2024-24579","score":0.00393,"percentile":0.33545,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hpxr-w9w7-g4gv","url":"https://osv.dev/vulnerability/GHSA-hpxr-w9w7-g4gv","summary":"stereoscope vulnerable to tar path traversal when processing OCI tar archives","modified":"2026-09-10T03:50:00.234495835Z","packages":[{"ecosystem":"Go","name":"github.com/anchore/stereoscope","purl":"pkg:golang/github.com/anchore/stereoscope","ranges":["<0.0.1"],"fixed":["0.0.1"]}]},{"id":"GO-2024-2490","url":"https://osv.dev/vulnerability/GO-2024-2490","summary":"Path traversal in github.com/anchore/stereoscope","modified":"2026-02-04T02:51:05.189073Z","packages":[{"ecosystem":"Go","name":"github.com/anchore/stereoscope","purl":"pkg:golang/github.com/anchore/stereoscope","ranges":["<0.0.1"],"fixed":["0.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}