{"id":"GO-2026-5422","summary":"apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko","details":"apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko","aliases":["CVE-2026-42575","GHSA-hcwr-pq9g-rq3m"],"modified":"2026-07-22T20:59:40.342634492Z","published":"2026-06-25T22:34:31Z","related":["CGA-wrg6-rwvj-pmff"],"database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-5422"},"references":[{"type":"ADVISORY","url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42575"},{"type":"WEB","url":"https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa"},{"type":"WEB","url":"https://github.com/chainguard-dev/apko/releases/tag/v1.2.7"}],"affected":[{"package":{"name":"chainguard.dev/apko","ecosystem":"Go","purl":"pkg:golang/chainguard.dev/apko"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5422.json"}}],"schema_version":"1.7.5"}