Critical Security Flaws in Image-Builder Package: Important Update Required
Summary
RLSA-2026:67138: Important: image-builder security update. Affects image-builder versions < 0:52.1-2.el9_8. Fixed in 0:52.1-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary tool designed for creating customized OS artifacts, including virtual machine images and OSTree commits. It leverages osbuild for its operations, making it a vital component in the Rocky Linux ecosystem. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerabilities stem from multiple Cross-Site Scripting (XSS) issues in the golang.org/x/net/html package, which is used by image-builder. These include a parsing bypass, arbitrary code execution, and unexpected HTML tree rendering, all of which could allow an attacker to execute malicious scripts in the context of a user's session. Additionally, the OpenTelemetry-Go library has a Denial of Service vulnerability due to oversized baggage headers. The ramifications of these vulnerabilities can lead to severe security breaches, including data theft and service disruptions.
How To Fix
Minimum fixed version
0:52.1-2.el9_8
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the affected features of the image-builder package until the update is applied. Additionally, consider implementing input validation and sanitization in your applications to mitigate the risk of XSS attacks.
Conclusion
In summary, the image-builder package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to maintain the security of your applications. Utilize tools like Vulert to monitor for vulnerabilities and ensure your software remains secure.
See every vulnerability recorded for image-builder →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities could lead to Cross-Site Scripting attacks, allowing attackers to execute malicious scripts, steal data, or disrupt services.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and avoid using features that are vulnerable until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
