B42/100
Vulnerability · high
LXD argument injection in backup compression enables file write and code execution
Tier B · Patch this week – Put it in the sprint
Who’s exposed: LXD users with backup compression enabled
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Full takeover
The Brief
- GitHub Advisory Database published an advisory on 2026-11-06 for LXD (github.com/canonical/lxd).
- The advisory says improper validation of the user-provided backup compression algorithm causes argument injection into the constructed command line.
- According to the advisory, this leads to arbitrary file write and code execution.
Why it matters
Developers and operators running LXD with backups should check the advisory for affected and fixed versions, since the flaw can lead to code execution.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | LXD is a container and VM manager that ops and dev teams run and operate. |
| No | Core infrastructure | LXD is a specialized virtualization tool, not core infrastructure like OpenSSH or the Linux kernel. |
| No | Popular tool | LXD is a niche system-container manager, not a widely used mainstream developer tool. |
| No | Exploited in the wild | GitHub Advisory Database reports only the vulnerability; no source reports observed attacks. |
| No | Public exploit | GitHub Advisory Database describes the issue; no source says exploit code or a PoC is published. |
| No | Remote, no login | GitHub Advisory Database does not say the attack needs no credentials; backup operations imply authenticated access. |
| Yes | Full takeover | GitHub Advisory Database: argument injection leads to arbitrary file write and arbitrary code execution. |
| No | Secrets exposed | No source reports credentials, keys, configs or data being stolen or exposed. |
| No | Supply chain | Sources describe a command injection flaw in backup compression, not compromised packages, updates or pipelines. |
| No | No fix yet | Sources do not state whether a patched version exists, so no fix-absent status is reported. |
Timeline
GitHub Advisory Database publishes LXD argument injection advisory
GitHub Advisory Database
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Source
LXD has argument injection in backup compression algorithm leading to AFW and ACE ↗ GitHub Advisory Database · 3h ago
First seen · 1 source · Full story page · How tiers are decided