BuildKit’s low‑level API can set git.checkoutbundle=true when checking out Git sources. An attacker able to supply a malicious Git bundle can have that bundle’s checkout sequence execute crafted host commands, which is a classic command‑injection flaw classified as CWE‑88. The consequence is full host compromise, allowing attackers to read or modify files, install additional malware, or exfiltrate data.

The flaw affects BuildKit, the build engine used by Docker. Any BuildKit instance that employs a custom frontend or directly uses the raw API with git.checkoutbundle enabled is vulnerable. No specific version range is disclosed, so all BuildKit releases lacking the patch are potentially vulnerable.

The CVSS score is 6.5, indicating moderate severity, yet the impact of command injection is high. < 1%, indicating current exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. malicious Git source and either use a custom frontend or invoke the raw API; the likely attack vector would involve a BuildKit coordinator or a privileged user with the ability to configure pipelines or provide source bundles. Remote unauthenticated exploitation is unlikely unless the BuildKit service is exposed to untrusted networks.