NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

Contrast BadAML injection allows arbitrary code executionGHSA-g9ww-x58f-9g6m

HIGH

GHSA-g9ww-x58f-9g6m is a high-severity (CVSS 8.4) Code Injection vulnerability in github.com/edgelesssys/contrast. A fix is available for github.com/edgelesssys/contrast — see the affected versions and patch details below.

Also known asCVE-2026-100839GO-2026-4863
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-g9ww-x58f-9g6m.

EPSS Exploitation Probability

via FIRST.org ↗
0.1%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs4th percentile — riskier than 4% of all scored CVEsHighest risk
0.00%0.22%0.43%0.65%0.1%0.1%0.1%Oct 26Nov 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐹github.com/edgelesssys/contrast

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

BadAML

BadAML is an AML injection attack that exploits the ACPI interface and allows arbitrary code execution in a confidential VM. The attack was first published in 2024:

Impact

An attacker with control over the host (which is assumed in the attacker model of Contrast) can execute malicious AML code to gain arbitrary code execution within the confidential guest.

AML is byte code embedded in ACPI tables that are passed from the host (QEMU) to the guest firmware (OVMF), and then passed from OVMF to the Linux kernel. The Linux kernel has an interpreter that executes the AML code. An attacker can craft a table with malicious AML code and the kernel will execute it. AML is Turing-complete and the interpreter has access to the full guest memory, including private pages.

See the paper for a detailed description and background of the attack.

Note that this is not a vulnerability specific to Contrast, but rather a generic vulnerability in Confidential Computing setups that use the ACPI interface.

Affected platforms

This issue affects the SNP platforms supported by Contrast: Metal-QEMU-SNP and Metal-QEMU-SNP-GPU. Users on these platforms should switch to the fixed Contrast version immediately.

Metal-QEMU-TDX isn't affected, as the content of the ACPI tables is covered by the runtime measurements (measured into RTMR 0 by OVMF) on Intel TDX.

Patches

A sandbox similar to the one proposed in the paper has been implemented in the Linux kernel used by Contrast. The sandbox denies access to private memory pages by doing a page table lookup on every read/write by the AML interpreter.

This mitigates the attack completely: While an attacker can still run AML code, the code cannot read or modify private memory pages. Shared pages are readable/writable by the host hypervisor anyway.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/edgelesssys/contrastall versions1.18.0go get github.com/edgelesssys/contrast@v1.18.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/edgelesssys/contrast, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/edgelesssys/contrast to 1.18.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g9ww-x58f-9g6m is resolved across your whole dependency graph.

  3. Workarounds

    Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Frequently Asked Questions

# BadAML BadAML is an AML injection attack that exploits the ACPI interface and allows arbitrary code execution in a confidential VM. The attack was first published in 2024: - <https://blackhat.com/eu-24/briefings/schedule/#aml-injection-attacks-on-confidential-vms-42723> - <https://dl.acm.org/doi/pdf/10.1145/3719027.3765123> ## Impact An attacker with control over the host (which is assumed in the attacker model of Contrast) can execute malicious AML code to gain arbitrary code execution within the confidential guest. AML is byte code embedded in ACPI tables that are passed from the host
O3 Security · Impact-Aware SCA

Is GHSA-g9ww-x58f-9g6m in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Contrast BadAML injection allows arbitrary code execution