ciguard is a static security auditor used in CI/CD pipelines. The published container image from version 0.1.0 to 0.8.1 lacks a USER directive in its Dockerfile, so it inherits the default root user. This means any process running inside the container during a pipeline execution runs with root privileges, introducing improper privilege management and the potential for privilege escalation within the CI environment. The CVSS score of 3 reflects a low severity impact under normal conditions, but the presence of root access in the container could be leveraged by an attacker who gains influence over the CI process.

Jo‑Jo98 provides ciguard, a static security auditor container image. Versions from 0.1.0 to 0.8.1 are affected because the image runs as root. The issue was resolved in version 0.8.2.

The CVSS score of 3 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves using the vulnerable container image within a CI/CD pipeline. An attacker who can influence the pipeline could execute privileged commands inside the container because it runs as root. Since the container runs as root, privilege could be used to compromise downstream services if host isolation or capabilities are not properly restricted. The impact remains confined to the CI environment unless additional escape mechanisms exist, and the lack of KEV listing suggests widespread exploitation has not been observed.