Opam
by Ocaml
Source repositories
CVEs (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-41082 | Hig | 0.40 | 7.3 | 0.00 | Apr 16, 2026 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. | ||
| CVE-2026-57825 | Med | 0.30 | 5.7 | 0.00 | Sep 9, 2026 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files. |
- risk 0.40cvss 7.3epss 0.00
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
- risk 0.30cvss 5.7epss 0.00
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.