Read the docs
TI-2026-41643 Aliases CVE-2026-57825GHSA-rwq5-7hr3-r2qf

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be…

Priority LOW 26CWE-61Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed opam (OCaml): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OCamlopambefore 2.5.22.5.2Patch availableCNA
  • opam VendorOCaml Affected before 2.5.2 Fixed in 2.5.2 Patch available CNA

Remediation

  • Fix · CNA opam (OCaml) Fixed in 2.5.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57825
  2. 2026-10-03 Alias added: GHSA-rwq5-7hr3-r2qf

References

Other 2

  • TI-2026-60369 Improper signature verification in OCaml jose CVSS 3.1CRITICAL 9.1
  • TI-2026-59889 An issue was discovered in the utcp package before 0.0.6 for OCaml. CVSS 3.1HIGH 7.5
  • TI-2026-29719 In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVSS 3.1HIGH 7.8
  • TI-2026-59888 Improper certificate validation in OCaml mirage-crypto-ec CVSS 3.1MEDIUM 6.2
  • TI-2026-59887 Improper signature verification in OCaml mirage-crypto CVSS 3.1MEDIUM 6.2
  • TI-2018-07003 The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml… CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences