CVE-2026-19589
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability is fixed in Packer 1.16.0.
Risk Assessment
The risk is the potential for arbitrary code execution on the user's system, which could lead to full system compromise or data theft. However, the attack requires user interaction with a malicious plugin source.
Recommendation
It is recommended to immediately upgrade Packer to version 1.16.0 or later. Also, avoid installing plugins from untrusted sources.
Original NVD description (English source)
Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.