github.com/zarf-dev/zarf (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/zarf-dev/zarf, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2026-29064 — CVSS 8.2 (high): Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in…
• CVE-2026-40090 — CVSS 7.1 (high): Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in…