{"uuid": "1e51d1e3-276b-46a7-abd5-5fcf9a1d582b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/dystewart/7127d826eefe32ba23981e94fb701fb3", "content": "# SPDX-FileCopyrightText: Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.\n# SPDX-License-Identifier: Apache-2.0\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\nARG BASE_IMAGE_URL=registry.access.redhat.com/ubi9/ubi\nARG BASE_IMAGE_TAG=9.8-1782841664\nARG PYTHON_VERSION=3.12\n\n# Specified on the command line with:\n# --build-arg VULN_ANALYSIS_VERSION=$(python -m setuptools_scm)\nARG VULN_ANALYSIS_VERSION=2.0.0\n\nFROM ${BASE_IMAGE_URL}:${BASE_IMAGE_TAG} AS base\n\nCOPY --from=ghcr.io/astral-sh/uv:0.7.15 /uv /uvx /bin/\n\nARG VULN_ANALYSIS_VERSION\nARG PYTHON_VERSION\nARG AGENT_GIT_COMMIT\nARG AGENT_GIT_TAG\n\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    AGENT_GIT_COMMIT=${AGENT_GIT_COMMIT} \\\n    AGENT_GIT_TAG=${AGENT_GIT_TAG}\n\nRUN dnf install -y --nodocs \\\n      bsdtar \\\n      ca-certificates \\\n      gcc \\\n      gcc-c++ \\\n      git \\\n      git-lfs \\\n      krb5-devel \\\n      libatomic \\\n      make \\\n      python3.12 \\\n      python3.12-devel \\\n      skopeo \\\n      wget \\\n      xz \\\n    && dnf clean all \\\n    && update-ca-trust\n\n# Install Go.\nRUN curl -L \\\n      https://go.dev/dl/go1.24.1.linux-amd64.tar.gz \\\n      -o /tmp/go1.24.1.linux-amd64.tar.gz \\\n    && tar -C /usr/local \\\n      -xzf /tmp/go1.24.1.linux-amd64.tar.gz \\\n    && rm -f /tmp/go1.24.1.linux-amd64.tar.gz\n\nENV GOTOOLCHAIN=auto\n\n# Install Node.js and npm.\n# CVE-2026-13149: brace-expansion DoS.\nARG NODE_VERSION=26.5.0\n\nRUN curl -fsSL \\\n      -o /tmp/node.tar.xz \\\n      \"https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz\" \\\n    && mkdir -p /opt/nodejs \\\n    && tar -C /opt/nodejs \\\n      -xJf /tmp/node.tar.xz \\\n      --strip-components=1 \\\n    && rm -f /tmp/node.tar.xz\n\nENV PATH=\"/opt/nodejs/bin:${PATH}\"\n\n# CVE-2026-42338:\n# ip-address <10.1.1 XSS, transitively included through npm/socks.\nRUN cd /tmp \\\n    && npm pack ip-address@10.1.1 \\\n    && tar -xzf ip-address-*.tgz \\\n    && rm -rf /opt/nodejs/lib/node_modules/npm/node_modules/ip-address \\\n    && mv package /opt/nodejs/lib/node_modules/npm/node_modules/ip-address \\\n    && rm -f /tmp/ip-address-*.tgz \\\n    && rm -rf /tmp/package\n\n# npm <=11.17 bundles brace-expansion <=5.0.6.\nRUN npm install -g npm@11.18.0 \\\n    && node --version \\\n    && npm --version\n\n# Install Temurin JDK 17.\nARG JDK_URL=\"https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_x64_linux_hotspot_17.0.18_8.tar.gz\"\nARG JDK_DIR=\"jdk-17.0.18+8\"\n\nRUN mkdir -p /opt/jdk \\\n    && curl -fsSL \\\n      -o /tmp/jdk.tgz \\\n      \"${JDK_URL}\" \\\n    && tar -C /opt/jdk \\\n      -xzf /tmp/jdk.tgz \\\n    && rm -f /tmp/jdk.tgz\n\nENV JAVA_HOME=\"/opt/jdk/${JDK_DIR}\"\nENV PATH=\"${JAVA_HOME}/bin:${PATH}\"\n\n# Install Maven.\nARG MVN_VER=3.9.11\n\nRUN curl -fsSL \\\n      -o /tmp/maven.tgz \\\n      \"https://archive.apache.org/dist/maven/maven-3/${MVN_VER}/binaries/apache-maven-${MVN_VER}-bin.tar.gz\" \\\n    && tar -C /opt \\\n      -xzf /tmp/maven.tgz \\\n    && rm -f /tmp/maven.tgz\n\nENV PATH=\"/opt/apache-maven-${MVN_VER}/bin:${PATH}\"\n\nRUN java -version \\\n    && mvn -v\n\n# Configure the RHEL/UBI CA trust bundle.\nENV REQUESTS_CA_BUNDLE=\"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\" \\\n    SSL_CERT_FILE=\"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\"\n\n# Install Tini.\nADD --chmod=755 \\\n    --checksum=sha256:93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c \\\n    https://github.com/krallin/tini/releases/download/v0.19.0/tini \\\n    /tini\n\nSHELL [\"/bin/bash\", \"-c\"]\n\nWORKDIR /workspace\n\n# Copy the project, including the merged OpenShell compatibility changes.\nCOPY ./ /workspace\n\n# Create a named development user. OpenShift may replace this UID with an\n# arbitrary namespace-assigned UID at runtime.\nRUN groupadd workspace-group \\\n    && useradd \\\n      --uid 1001 \\\n      --create-home \\\n      --gid workspace-group \\\n      user1001 \\\n    && chown -R user1001:workspace-group /home/user1001 \\\n    && chmod -R g+wrx /home/user1001\n\nRUN --mount=type=cache,id=uv_cache_v006,target=/home/user1001/.cache/uv,mode=0775 \\\n    export SETUPTOOLS_SCM_PRETEND_VERSION=\"${VULN_ANALYSIS_VERSION}\" \\\n    && export UV_CACHE_DIR=/home/user1001/.cache/uv \\\n    && UV_PYTHON_DOWNLOADS=never \\\n       uv venv \\\n       --python /usr/bin/python3.12 \\\n       /workspace/.venv \\\n    && UV_PYTHON_DOWNLOADS=never \\\n       uv sync --frozen --verbose\n\nRUN chown -R user1001:0 /workspace \\\n    && chmod -R g=u /workspace\n\n# OpenShift runs containers with an arbitrary UID belonging to group 0.\n# Give group 0 the same permissions as the owning user.\nRUN chgrp -R 0 \\\n      /workspace \\\n      /home/user1001 \\\n    && chmod -R g=u \\\n      /workspace \\\n      /home/user1001 \\\n    && mkdir -p /opt/exploit-iq \\\n    && chgrp -R 0 /opt/exploit-iq \\\n    && chmod -R g=u /opt/exploit-iq\n\n# Embed the validated OpenAI/OpenShell NAT configuration.\n# API keys and the HMAC key are supplied separately at runtime.\nCOPY --chown=1001:0 \\\n    config-openai.yaml \\\n    /opt/exploit-iq/config-openai.yaml\n\nUSER 1001\n\nENV PATH=\"/workspace/.venv/bin:/usr/local/go/bin:${PATH}\"\n\nRUN echo \"source /workspace/.venv/bin/activate\" \\\n    >> /home/user1001/.bashrc\n\n# Runtime image.\nFROM base AS runtime\n\nENV PYTHONPATH=\"/workspace/src\" \\\n    EXPLOIT_IQ_TRUST_PROXY_DNS=\"true\" \\\n    OPENAI_BASE_URL=\"https://api.openai.com/v1\" \\\n    OPENAI_API_BASE=\"https://api.openai.com/v1\" \\\n    SERPAPI_BASE_URL=\"https://serpapi.com\" \\\n    NVD_BASE_URL=\"https://services.nvd.nist.gov\" \\\n    GHSA_BASE_URL=\"https://api.github.com\" \\\n    CWE_DETAILS_BASE_URL=\"https://cwe.mitre.org/data/definitions\" \\\n    TIKTOKEN_CACHE_DIR=\"/sandbox/.cache/tiktoken\" \\\n    HF_HUB_CACHE=\"/sandbox/.cache/huggingface\" \\\n    XDG_CACHE_HOME=\"/sandbox/.cache/am_cache\" \\\n    CHECKLIST_MODEL_NAME=\"gpt-4o-mini\" \\\n    CODE_VDB_RETRIEVER_MODEL_NAME=\"gpt-4o-mini\" \\\n    DOC_VDB_RETRIEVER_MODEL_NAME=\"gpt-4o-mini\" \\\n    CVE_AGENT_EXECUTOR_MODEL_NAME=\"gpt-4o-mini\" \\\n    GENERATE_CVSS_MODEL_NAME=\"gpt-4o-mini\" \\\n    SUMMARIZE_MODEL_NAME=\"gpt-4o-mini\" \\\n    JUSTIFY_MODEL_NAME=\"gpt-4o-mini\" \\\n    EMBEDDER_MODEL_NAME=\"text-embedding-3-small\"\n\nEXPOSE 26466\n\nCMD [\"/workspace/.venv/bin/nat\", \"serve\", \"--config_file=/opt/exploit-iq/config-openai.yaml\", \"--host=0.0.0.0\", \"--port=26466\"]", "creation_timestamp": "2026-09-14T15:48:47.768702Z"}