CVE-2025-15558: affected range for github.com/docker/cli is unbounded
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
Executing docker scout cves traefik:v3.7.1 --only-vuln-packages reports github.com/docker/cli@29.4.0+incompatible as affected by CVE-2025-15558 (GHSA-p436-gjf2-799p) with an unbounded affected range and no fixed version.
The upstream GitHub advisory gates this CVE to < v29.2.0 and marks it fixed in v29.2.0, so v29.4.0 is past the fix and should not match.
The scout CVE-2025-1558 details page is reporting the same information.
I'm not sure if this is the right place to report this issue, but what would be the best way to fix it?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing docker scout cves traefik:v3.7.1 --only-vuln-packages and compare the reported CVE-2025-15558 data with the linked GitHub advisory. Trace where Docker Scout obtains the affected range and fixed version, then verify that github.com/docker/cli@29.4.0 is no longer reported while versions below v29.2.0 remain affected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100