CVE-2026-57825

MediumCVSS 5.7

Published: 09/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

Risk Assessment

An attacker could bypass the sandbox and gain unauthorized access to the system or data, potentially leading to integrity and confidentiality breaches.

Recommendation

Update opam to version 2.5.2 or later if possible, and avoid using unverified .install files.

Other vulnerabilities in opam

CVE-2026-41082High
In OCaml opam before version 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Original NVD description (English source)

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.