VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/sylabs/singularity: vulnerability history, versions and safety

github.com/sylabs/singularity is a package in the Go ecosystem. Vulert records 11 vulnerabilities for it across 120 releases, from May 2021 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
11 vulnerabilities recorded H8 M1 U2
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/sylabs/singularity vulnerabilities

Vulert verdict on github.com/sylabs/singularity v3.1.1+incompatible i

Updated on 23 Oct 2026

Careful: 2 of the 11 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 62/100
  • Security Some issues to review
  • Maintenance Maintaining
  • Popularity Widely used
  • Community Quiet

What to do: Plan around the 2 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v3.1.1+incompatible — unaffected i
  • Vulnerabilities on record 11 over 5 years · 2 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 8.8 i
  • With no published fix 2 i
  • Stars 996 i
  • OpenSSF scorecard 3/10 i
  • Last release 32 months ago i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/sylabs/singularity, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20240124132338-d56bcb587cb9 24 Jan 2024 H1 U2 BSD-3-Clause No Details →
v0.0.0-20231130105644-b3e58c5507c9 30 Nov 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20231117111819-c8346ab1c7e4 17 Nov 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230731083700-61a3083f0c3c 31 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230728132739-aac931ed7147 28 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230728105422-3445f7a6558e 28 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230728084034-6ee24d1a7821 28 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230727154138-6be8ea11c074 27 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230727085254-c53314889f93 27 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230726165915-67c4e2e977bf 26 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230726134419-0737f3a496e8 26 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230726082754-187574f24a4f 26 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230725171355-5bd41378831f 25 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230725103433-bec7b14d85c2 25 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230725082126-6bdb5e918acf 25 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230724183123-8d4360b9d85a 24 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230724133646-e2976d9c6696 24 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230724130609-43aa6cec0bd7 24 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230721173934-b70ef92b0a59 21 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230721161730-b9d482e2c3fc 21 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230721155909-925071a7b8ce 21 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230721151750-9cf1bbea88eb 21 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230721141008-60816c887a70 21 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230721084851-535992e27599 21 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230720175204-0007f5e64207 20 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230720170445-0a5834c9d0c9 20 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230720160003-f02bc8528b6b 20 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230720154112-5d34eb546eef 20 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230720123548-3c59ed21a851 20 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230719124013-e4b97fa6e15e 19 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230718161419-37257d4ffb1d 18 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230718133150-0ccef06bd874 18 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230718083643-3812234ff6a1 18 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230717124954-4b87ddb52b64 17 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230714162533-3a163fb70fe2 14 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230714155902-30461b2b9996 14 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230714142703-b6ecbb5dcefb 14 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230714092644-418c306492ae 14 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230713152359-adf587dee208 13 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230713144754-5707da8bc54d 13 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230713141339-30f76f04be0e 13 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230713095736-3ed1049bf148 13 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230712160129-476c4bcfcfb4 12 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230712153325-efee3c6c5607 12 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230712135518-9a31346db09f 12 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230712134554-87346dc0871c 12 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711155047-0881099083ea 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711123214-285d75e4eeb0 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711120637-7017c2e33bc5 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711091400-1c93f8d0dc9a 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711082205-21e7c5a5edca 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711081844-3e2e031119db 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230711081303-5d7f5606793b 11 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230710150459-19223768028d 10 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230710143858-546292e986d7 10 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230707103654-c8984cd6d976 07 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230707081218-825b20b70c8b 07 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230706171732-c20b6b6e2771 06 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230706135158-158978ca8c6b 06 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230705152943-1a8f98175d7c 05 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230705100545-c7e5d303554a 05 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230705094917-3a14cd31847b 05 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230703102255-1a6be97ac18a 03 Jul 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230630115934-005b63dc7456 30 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230629123615-fd7021b20bde 29 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230628164816-ba73486958e9 28 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230626154158-b256c8f82fdc 26 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230626130140-ecbbbdbf08b4 26 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230623102844-0bf435f525cc 23 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230622134731-e0fc9f920310 22 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230621155414-d04ae0e8d778 21 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230621152631-46a773f686a6 21 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230621150711-65e1433179ae 21 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230621135655-1c9b981a7277 21 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230621081319-fe39b52d40ca 21 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230620163406-757b05a3adf0 20 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230620134509-2222f35efe36 20 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230619162017-084d3f1b224f 19 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230619143845-70ba8ad409d4 19 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230619141036-b25b44306bdb 19 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230619090730-9dfd3c2e669d 19 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230619084526-97d92e3dee92 19 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230615153607-b1618fbb65c2 15 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230615120813-4862f9ffaab7 15 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230615113606-69f30bbe2615 15 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230614155507-486253c74aa2 14 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230614110208-85a8174ccfca 14 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230614101735-7055abeeae3d 14 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230613142827-aa1d137cc9d1 13 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230613123617-6160f6891cf0 13 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230613115219-46a613896b54 13 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230612170135-0a7a351c4152 12 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230612162730-533507ecdad6 12 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230612141907-d191e3f77c21 12 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230608144206-836ab96c5c19 08 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230608102941-54afd2c5e145 08 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230607161413-60a6afb2184a 07 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230606153636-4962ce3bfdc7 06 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230606141550-904b4fb9b215 06 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230601105054-6b76c5958a06 01 Jun 2023 H1 U2 BSD-3-Clause No Details →
v0.0.0-20230530085314-1d07c58e11e9 30 May 2023 H1 U2 — No Details →
v0.0.0-20230526081515-dbae3a419c34 26 May 2023 H1 U2 — No Details →
v0.0.0-20230524140401-ef8ad375858a 24 May 2023 H1 U2 — No Details →
v0.0.0-20230519152210-e7ee6d5c95b9 19 May 2023 H1 U2 — No Details →
v0.0.0-20230519145528-35df32226760 19 May 2023 H1 U2 — No Details →
v0.0.0-20230519075018-2b0d5f6b30fd 19 May 2023 H1 U2 — No Details →
v0.0.0-20230518150220-78729e5f1e64 18 May 2023 H1 U2 — No Details →
v0.0.0-20230518101508-bbd90d0a954d 18 May 2023 H1 U2 — No Details →
v0.0.0-20230517201457-7a37f70ac1a3 17 May 2023 H1 U2 — No Details →
v0.0.0-20230517113314-496dac34f406 17 May 2023 H1 U2 — No Details →
v0.0.0-20230515091718-f5aabe3d1198 15 May 2023 H1 U2 — No Details →
v0.0.0-20230512164556-cd6fa5c0d836 12 May 2023 H1 U2 — No Details →
v0.0.0-20230512154950-062356f162e4 12 May 2023 H1 U2 — No Details →
v0.0.0-20230511135940-64844dc02f44 11 May 2023 H1 U2 — No Details →
v0.0.0-20230510130500-adb901001059 10 May 2023 H1 U2 — No Details →
v0.0.0-20230510113124-a0b3f59ee0b3 10 May 2023 H1 U2 — No Details →
v0.0.0-20230509130959-8158acdffadf 09 May 2023 H1 U2 — No Details →
v0.0.0-20230505105839-5f101f947148 05 May 2023 H1 U2 — No Details →
v0.0.0-20230505103530-5833f7b91772 05 May 2023 H1 U2 — No Details →
v0.0.0-20230505090828-c385e888e710 05 May 2023 H1 U2 — No Details →

The newest 120 of 11,989 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 7
  • 2022 2
  • 2025 1
  • 2026 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 11 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/sylabs/singularity

The 5 most severe of 11 vulnerabilities recorded for this package

Search all 11 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2019-11328: Incorrect Permission Assignment for Critical Resource in Singularity 8.8 high 3.2.0 20 Dec 2021
CVE-2020-25040: Insecure permissions on build temporary rootfs in Singularity 8.8 high 3.6.3 24 May 2021
CVE-2020-15229: Path Traversal and Files Overwrite in Singularity 8.2 high 3.6.4 24 May 2021
CVE-2020-25039: Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity 8.1 high 3.6.3 20 Dec 2021
CVE-2018-19295: Sylabs Singularity Improper Input Validation 7.8 high 2.6.1 14 May 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/sylabs/singularity

Is github.com/sylabs/singularity safe to use?

Vulert records 11 vulnerabilities for github.com/sylabs/singularity in Go: 0 critical, 8 high, 1 medium and 0 low, plus 2 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/sylabs/singularity's Vulert package health score?

Vulert scores github.com/sylabs/singularity 62/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/sylabs/singularity should I use?

v3.1.1+incompatible is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/sylabs/singularity have?

11 vulnerabilities are recorded for github.com/sylabs/singularity in the Go ecosystem: 0 critical, 8 high, 1 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/sylabs/singularity vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/sylabs/singularity in the last 12 months, and the oldest entry in this database dates to 24 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/sylabs/singularity are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/sylabs/singularity for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/sylabs/singularity version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.