Vulnerabilities

TI-2026-34803 CVE-2026-47215 · GHSA-wqcr-7rf3-f64m

Singularity: Incorrect path matching for 'limit container paths' directive

LOW 21

SingularityCE and SingularityPRO are open source container platforms.

CVSS 3.1MEDIUM 4.8 Local Low privileges User interaction EPSS 0.00155 Published 2026-09-15 Fixed in 4.4.2, 4.1.14 +1 CWE-22

TI-2025-40088 CVE-2025-64750 · GHSA-wwrx-w7c9-rf87

Singluarity ineffectively applies of selinux / apparmor LSM process labels

LOW 20

SingularityCE and SingularityPRO are open source container platforms.

CVSS 3.1MEDIUM 4.5 Local No auth User interaction EPSS 0.00172 Published 2025-12-02 Fixed in 4.1.11, 4.3.5 CWE-61

TI-2023-14384 CVE-2023-30549 · GHSA-j4rf-7357-f4cg

Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

LOW 34

Apptainer is an open source container platform for Linux.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00369 Published 2023-04-25 Fixed in 1.1.8 CWE-416

TI-2022-07593 CVE-2022-23538 · GHSA-7p8m-22h4-9pj7

User credentials leaked to third-party service via HTTP redirect in scs-library-client

LOW 35

github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00742 Published 2023-01-17 Fixed in 1.34, 1.4.2 +1 CWE-522

TI-2022-18614 CVE-2022-39237 · GHSA-m5m3-46gj-wch8

Digital Signature Hash Algorithms Not Validated in sylabs/sif

MEDIUM 43

syslabs/sif is the Singularity Image Format (SIF) reference implementation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0065 Published 2022-10-06 Fixed in 2.8.1 CWE-347

TI-2021-12634 CVE-2021-33027 · GHSA-8jh5-pc7c-26pc

Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.

MEDIUM 45

Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01289 Published 2021-07-19 No fix listed CWE-331

TI-2021-12997 CVE-2021-33622 · GHSA-cq54-mjwx-5pjw

Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect…

MEDIUM 45

Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01258 Published 2021-06-15 No fix listed CWE-754

TI-2021-12304 CVE-2021-32635 · GHSA-5mv9-q7fq-9394

Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

LOW 31

Singularity is an open source container platform.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.01415 Published 2021-05-28 Fixed in 3.7.4 CWE-20

TI-2021-10207 CVE-2021-29499 · GHSA-4gh8-x3vv-phhg

Predictable SIF UUID Identifiers

LOW 35

SIF is an open source implementation of the Singularity Container Image Format.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00958 Published 2021-05-07 Fixed in 1.2.3 CWE-330

TI-2021-10007 CVE-2021-29136 · GHSA-9m95-8hx6-7p9v

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host…

LOW 25

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00344 Published 2021-04-06 Fixed in 0.4.7 CWE-20

TI-2020-12001 CVE-2020-15229 · GHSA-7gcp-w6ww-2xv9

Path traversal and files overwrite with unsquashfs

MEDIUM 44

Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.02046 Published 2020-10-14 Fixed in 3.6.4 CWE-22

TI-2020-15301 CVE-2020-25040 · GHSA-jv9c-w74q-6762

Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used…

MEDIUM 42

Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0204 Published 2020-09-16 Fixed in 3.6.3 CWE-668

TI-2020-15300 CVE-2020-25039 · GHSA-w6v2-qchm-grj7

Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories…

LOW 39

Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02014 Published 2020-09-16 Fixed in 3.6.3 CWE-668

TI-2020-10832 CVE-2020-13846 · GHSA-6w7g-p4jh-rf92

Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

LOW 36

Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01336 Published 2020-07-14 Fixed in 3.6.0

TI-2020-10831 CVE-2020-13845 · GHSA-pmfr-63c2-jr5c

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value.

LOW 33

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00517 Published 2020-07-14 Fixed in 3.6.0 CWE-347

TI-2020-10833 CVE-2020-13847

Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check.

LOW 34

Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00629 Published 2020-07-14 No fix listed CWE-354

TI-2019-14210 CVE-2019-19724 · GHSA-mj73-5x75-9phh

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by…

LOW 35

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed a…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01234 Published 2019-12-18 Fixed in 3.5.2 CWE-276

TI-2019-08462 CVE-2019-11328 · GHSA-557g-r22w-9wvx

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with…

MEDIUM 42

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02088 Published 2019-05-14 Fixed in 3.2.0 CWE-732

TI-2018-13679 CVE-2018-19295 · GHSA-p83v-8vmr-qfv9

Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.

LOW 34

Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0047 Published 2018-12-17 Fixed in 2.6.1 CWE-20

TI-2018-08615 CVE-2018-12021 · GHSA-4x32-h296-rg6j

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems…

LOW 32

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01465 Published 2018-07-05 Fixed in 2.5.2 CWE-200

Vulnerabilities

Filters