Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a v…

Affected: Go: github.com/sylabs/singularity

### Impact

Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the …

singularity-3.8.3-1.2 on GA media

Affected: Ubuntu:Pro:18.04:LTS: singularity-container, Ubuntu:Pro:24.04:LTS: singularity-container, Ubuntu:25.10: singularity-container, Ubuntu:26.04:LTS: singularity-container

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint…