hashicorp Packer vulnerabilities

Latest hashicorp Packer CVEs

Newest publication first

1. CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

   Published 2026-08-17

   High·CVSS 7.1 EPSS 0.19%

   Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026...

2. CVE-2018-15869 An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security bes...

   Published 2018-08-25

   Medium·CVSS 5.3 EPSS 1.8%

   An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Ama...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.