Vulnerabilities in pkg:golang/github.com/sylabs/singularity

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wqcr-7rf3-f64m",
  "modified" : "2026-06-04T17:38:21Z",
  "published" : "2026-06-04T17:38:21Z",
  "aliases" : [ "CVE-2026-47215" ],
  "summary" : "Singluarity: Incorrect path matching for 'limit container paths' directive",
  "details" : "### Impact\n\nThe `limit container paths` directive in `singularity.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed.\n\nFor example, the configuration:\n\n```\nlimit container paths = /data/safe\n```\n\nWill also allow containers in `/data/safe-but-unsafe` to be run.\n\n\n### Patches\n\nThis issue is patched in SingularityCE 4.4.2 and SingularityPRO 4.3.9 / 4.1.14\n\n### Workarounds\n\nIf you do not use the `limit container paths` functionality, then this issue does not affect your installation.\n\nIf you do use the `limit container paths` functionality then you must update. Please also review the documented limitations when user namespaces are enabled [1].",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/sylabs/singularity/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.4.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/sylabs/singularity"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "3.1.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f"
  }, {
    "type" : "WEB",
    "url" : "https://docs.sylabs.io/guides/latest/admin-guide/configfiles.html#limiting-container-execution"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sylabs/singularity"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sylabs/singularity/releases/tag/v4.4.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-04T17:38:21Z",
    "nvd_published_at" : null
  }
}