Skip to content
Heist/ feed
HighFix available

Contras Affected by CopyFile Policy Subversion via Symlinks

Type: advisorySource: OSV1 source record

### Impact The [Kata agent policies](https://docs.edgeless.systems/contrast/architecture/components/policies) generated by the Contrast CLI had an issue in the `CopyFile` verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series of `CopyFile` requests to overwrite security-critical files or trick the workload into disclosing sensitive data, which effectively amounts to a full guest takeover. ### Patches This issue has been patched in Contrast v1.19.1. Note that this fix does not change the fact that host-provided content is generally not trustworthy, as documented. ### Workarounds If upgrading is not possible, users can implement the fix in rego and pass it to `contrast generate --policy`. The rego-only fix is a bit trickier than the patch, because the data to check is binary. See the references for details. ### Resources * Upstream GHSA: https://github.com/kata-containers/kata-containers/security/advisories/GHSA-q49m-57vm-c8cc * Alternative policy-only fix: https://gist.github.com/burgerdev/304dd0ab0fff1665b7c27e18a30cf96e

Announced Source revision 1
Original source ↗

GHSA-rh99-wc69-c255

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-rh99-wc69-c255

github.com/edgelesssys/contrast

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.19.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.19.1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/edgelesssys/contrast",
      "purl": "pkg:golang/github.com/edgelesssys/contrast",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rh99-wc69-c255/GHSA-rh99-wc69-c255.json"
    }
  }
]
Related CVEs
CVE-2026-100838

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-100838 · High

contrast

Event
#19708 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement