{"uuid": "750ca965-d41f-49ad-92c5-340570ed013b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42338", "type": "seen", "source": "https://gist.github.com/dystewart/96e0a391116dd67ddc5f575f0732a337", "content": "# SPDX-FileCopyrightText: Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.\n# SPDX-License-Identifier: Apache-2.0\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\nARG BASE_IMAGE_URL=registry.access.redhat.com/ubi9/ubi\nARG BASE_IMAGE_TAG=9.8-1782841664\nARG PYTHON_VERSION=3.12\n\n# Specified on the command line with --build-arg VULN_ANALYSIS_VERSION=$(python -m setuptools_scm)\nARG VULN_ANALYSIS_VERSION=2.0.0\n\nFROM ${BASE_IMAGE_URL}:${BASE_IMAGE_TAG} AS base\nCOPY --from=ghcr.io/astral-sh/uv:0.7.15 /uv /uvx /bin/\nARG VULN_ANALYSIS_VERSION\nARG PYTHON_VERSION\nARG AGENT_GIT_COMMIT\nARG AGENT_GIT_TAG\n\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    AGENT_GIT_COMMIT=${AGENT_GIT_COMMIT} \\\n    AGENT_GIT_TAG=${AGENT_GIT_TAG}\n\nRUN dnf install -y --nodocs \\\n      bsdtar \\\n      ca-certificates \\\n      gcc \\\n      gcc-c++ \\\n      git \\\n      git-lfs \\\n      krb5-devel \\\n      libatomic \\\n      make \\\n      python3.12 \\\n      python3.12-devel \\\n      skopeo \\\n      wget \\\n      xz \\\n    && dnf clean all \\\n    && update-ca-trust\n\n\nRUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24.1.linux-amd64.tar.gz \\\n    && tar -C /usr/local -xzf /tmp/go1.24.1.linux-amd64.tar.gz \\\n    && rm /tmp/go1.24.1.linux-amd64.tar.gz\n\nENV GOTOOLCHAIN=auto\n\n# --- Node.js and npm (CVE-2026-13149: brace-expansion DoS) ---\nARG NODE_VERSION=26.5.0\nRUN curl -fsSL -o /tmp/node.tar.xz \\\n      \"https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz\" \\\n && mkdir -p /opt/nodejs \\\n && tar -C /opt/nodejs -xJf /tmp/node.tar.xz --strip-components=1 \\\n && rm -f /tmp/node.tar.xz\nENV PATH=\"/opt/nodejs/bin:${PATH}\"\n\n\n# CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7)\nRUN cd /tmp && \\\n    npm pack ip-address@10.1.1 && \\\n    tar -xzf ip-address-*.tgz && \\\n    rm -rf /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \\\n    mv package /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \\\n    rm -f /tmp/ip-address-*.tgz && \\\n    rm -rf /tmp/package\n\n# Verify Node.js and npm installation\n# npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release\nRUN npm install -g npm@11.18.0 \\\n && node --version && npm --version\n\n# --- Temurin JDK 17 (amd64/x86_64) ---\nARG JDK_URL=\"https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_x64_linux_hotspot_17.0.18_8.tar.gz\"\nARG JDK_DIR=\"jdk-17.0.18+8\"\nRUN mkdir -p /opt/jdk \\\n && curl -fsSL -o /tmp/jdk.tgz \"${JDK_URL}\" \\\n && tar -C /opt/jdk -xzf /tmp/jdk.tgz \\\n && rm -f /tmp/jdk.tgz\nENV JAVA_HOME=/opt/jdk/${JDK_DIR}\nENV PATH=\"${JAVA_HOME}/bin:${PATH}\"\n\n# --- Maven 3.9.11 (optional) ---\nARG MVN_VER=3.9.11\nRUN curl -fsSL -o /tmp/maven.tgz \\\n      \"https://archive.apache.org/dist/maven/maven-3/${MVN_VER}/binaries/apache-maven-${MVN_VER}-bin.tar.gz\" \\\n && tar -C /opt -xzf /tmp/maven.tgz \\\n && rm -f /tmp/maven.tgz\nENV PATH=\"/opt/apache-maven-${MVN_VER}/bin:${PATH}\"\n\n# Verify\nRUN java -version && mvn -v\n\n# Set SSL environment variables\nENV REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \\\n    SSL_CERT_FILE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\n\n# Add Tini\nADD --chmod=755 \\\n    --checksum=sha256:93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c \\\n    https://github.com/krallin/tini/releases/download/v0.19.0/tini /tini\n\nSHELL [\"/bin/bash\", \"-c\"]\n\n# Set working directory\nWORKDIR /workspace\n\n# Copy the project into the container\nCOPY ./ /workspace\n\nRUN groupadd workspace-group && \\\n    useradd -u 1001 -m -g workspace-group user1001 && \\\n    chown -R :workspace-group /home/user1001 && \\\n    chmod -R g+wrx /home/user1001\n\n\n\n# Install the NeMo Agent toolkit package and vuln analysis package\nRUN --mount=type=cache,id=uv_cache,target=/home/user1001/.cache/uv,mode=0775,sharing=locked \\\n    export SETUPTOOLS_SCM_PRETEND_VERSION=${VULN_ANALYSIS_VERSION} && \\\n    UV_PYTHON_DOWNLOADS=never uv venv --python /usr/bin/python3.12 /workspace/.venv && \\\n    uv sync && \\\n    chown -R :workspace-group /workspace && \\\n    chmod -R g+wrx /workspace && \\\n    chown -R :workspace-group /root && \\\n    chmod -R g+rx /root\n\nRUN chgrp -R 0 /workspace && chmod -R g=u /workspace\n\nUSER 1001\n\n# Activate the environment (make it default for subsequent commands)\n# Environment variables for the venv\nENV PATH=\"/workspace/.venv/bin:/usr/local/go/bin:$PATH\"\n\n# Activate the environment (make it default for subsequent commands)\nRUN echo \"source /workspace/.venv/bin/activate\" >> ~/.bashrc\n\n# ===== Setup for development =====\nFROM base AS runtime\nRUN --mount=type=cache,id=uv_cache,target=/root/.cache/uv,sharing=locked \\\n    source /workspace/.venv/bin/activate\n\n\nCMD [\"jupyter-lab\", \"--no-browser\", \"--allow-root\", \"--ip='*'\", \"--port=8000\", \"--NotebookApp.token=''\", \"--NotebookApp.password=''\"]\n", "creation_timestamp": "2026-09-02T18:04:42.033925Z"}