Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
2.1	✅
2.0	✅
1.2.x	✅
< 1.1	❌

Reporting a Vulnerability

Report security vulnerabilities to security@midnightbsd.org

mport package installation has symlink TOCTOU in chown and chmod handling
GHSA-23g3-7fv3-3ccf published Jun 6, 2026 by laffer1

High
mport audit can inspect the wrong package when options are present
GHSA-h3m9-vj4v-c35h published Jun 6, 2026 by laffer1

Moderate
mport verify can compare stale checksum data after hashing failures
GHSA-hgmr-9p75-q5cg published Jun 6, 2026 by laffer1

Low
mport mirror-selection ping accepts insufficiently validated ICMP replies
GHSA-qc2f-2j7j-m3r7 published Jun 6, 2026 by laffer1

Moderate
mport index decompression can leave partial or corrupt index data after zstd failures
GHSA-ffqj-j42r-747w published Jun 6, 2026 by laffer1

Moderate
mport bootstrap index fetch can continue after hash verification failure
GHSA-895r-rv8j-7g23 published Jun 6, 2026 by laffer1

High
mport package installation can overwrite existing unmanaged or differently owned files
GHSA-5773-7r4r-rpgx published Jun 6, 2026 by laffer1

Moderate
mport package bundle downloads allow unsafe destination filenames
GHSA-mr62-mqwj-vhh3 published Jun 6, 2026 by laffer1

High
mport trusts environment-controlled temporary directories in privileged metadata extraction
GHSA-4vv3-3h8r-q6mq published Jun 6, 2026 by laffer1

Moderate
mport sample file handling can write outside the configured root
GHSA-xqjc-rxmm-p27v published Jun 6, 2026 by laffer1

High

Learn more about advisories related to MidnightBSD/mport in the GitHub Advisory Database