Insufficient Containment in envd Development Environment by TensorChord

CVE-2026-128079

What is CVE-2026-128079?

The envd development environment tool has a vulnerability that allows potential exposure of files due to insufficient containment during the reading of host-side requirements files. This weakness exists in versions starting from 0.3.38 up to, but not including, 1.3.6. An attacker who can manipulate the build inputs may get sensitive file contents logged in debug logs or build-step metadata, depending on the permissions of the envd process. Notably, exploitation in version 1.3.5 requires simultaneous modification of relevant filesystem paths. Users are advised to upgrade to version 1.3.6 or later, where the issue has been addressed.

References