buildpacks/pack · Security & risks

Authoritative risk signals for buildpacks/pack — dependency CVEs (deps.dev), OpenSSF Scorecard, and GitHub Code Scanning. Not a substitute for your own security review.

Architecture Security & risks Dependencies License Maintenance Alternatives Vs Full analysis

Dependency CVEs (deps.dev)

Critical

0 direct

High

0 direct

Moderate

Deps scanned

25 direct

GHSA-pxq6-2prw-chj9 · github.com/docker/docker (direct)Moby has an Off-by-one error in its plugin privilege validationMODERATE
GHSA-rg2x-37c3-w2rh · github.com/docker/docker (direct)Docker: Race condition in docker cp allows bind mount redirection to host pathMODERATE
GHSA-vp62-88p7-qqf5 · github.com/docker/docker (direct)Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapMODERATE
GO-2026-6225 · github.com/chrismellard/docker-credential-acr-envCredential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-envMODERATE
GHSA-x86f-5xw2-fm2r · github.com/docker/docker (direct)Docker: `PUT /containers/{id}/archive` executes container binary on the hostMODERATE
GO-2026-4883 · github.com/docker/docker (direct)Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/dockerMODERATE
GO-2026-4887 · github.com/docker/docker (direct)Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/dockerMODERATE
GO-2026-5617 · github.com/docker/docker (direct)Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirectionMODERATE
GO-2026-5668 · github.com/docker/docker (direct)Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary filesMODERATE
GO-2026-5746 · github.com/docker/docker (direct)Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/dockerMODERATE

OpenSSF Scorecard · 5.9/10

Branch-Protection—
Token-Permissions0/10
Fuzzing0/10
Pinned-Dependencies0/10
Signed-Releases0/10
Code-Review3/10
CII-Best-Practices5/10
Maintained10/10

Ask AI about buildpacks/pack

Grounded in the actual source code. Pick a starter question or write your own.

What does this repo do, in one paragraph?How would I get started using it?What are the main alternatives?Show me the entry point.

Or write your own question

Informational only. RepoPilot summarises public signals at the time of analysis; they can be incomplete or stale. Not professional, security, or legal advice.