GoogleCVE-2026-87723
Google fuse-archive: untrusted search path
Medium5.4CVE-2026-87723 · Published Sep 28, 2026
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| fuse-archive Product | < 1.24 | 1.24 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-426
More Google advisories
All Google| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 25 | Google: code injection | High8.0 | 2.0.1 |
| Sep 25 | Google gVisor: code execution | High8.8 | 573a9e73cf844f |
| Sep 24 | Dell BOSS-N1 S-MCU Firmware Integrity and Cryptographic Verification Bypass | High | RefertoAdvisory |
| Sep 22 | A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK... | Critical9.1 | No fix yet |
| Sep 17 | Google Chrome: remote attacker could obtain cross-origin data | Medium4.3 | 153.0.8010.52 |
| Sep 17 | Google Chrome: type confusion | High8.8 | 153.0.8010.52 |