github.com/zarf-dev/zarf/src/pkg/archive (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/zarf-dev/zarf/src/pkg/archive, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (1)

• CVE-2026-29064 — CVSS 8.2 (high): Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in…