gcloud

Version: 577.0.0

Google Cloud CLI for managing Google Cloud resources

Install package

min add gcloud

Tool

Updated 9 days ago

Advisories: 25

What is "gcloud"?

Google Cloud CLI for managing Google Cloud resources

How to use this package

Quick install

Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.

min add gcloud

Declare as a task dependency in minimal.toml

Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.

[tasks.dev]
packages = ["gcloud"]

Build-time vs runtime

Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.

min add --build gcloud
min add --runtime gcloud

Compare versions

Dependencies (3)

Dependencies
Name	Version	Kind
base	—	build + runtime
glibc CVE:2	2.44	runtime
python CVE:8	3.14.6	runtime

Dependency changes

No direct advisories

This package inherits 15 transitive advisories from its dependencies.

Include transitive

Showing 15 transitive advisories via gcloud's dependencies

Security advisories for this package
	Status	IDs	Package	Version	Severity	Published
Critical (0)
High (6)
	Status	IDs	Package	Version	Severity	Published
	Under investigation	BIT-libpython-2026-15308 BIT-python-2026-15308 BIT-python-min-2026-15308 PSF-2026-33 CVE-2026-15308	python	3.14.4 – 3.14.6	High	21 days ago
Summary Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15308.json, https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/, https://nvd.nist.gov/vuln/detail/CVE-2026-15308 Fix: https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9, https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced, https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606, https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd, https://github.com/python/cpython/pull/153031 Report: https://github.com/python/cpython/issues/153030 Web: http://www.openwall.com/lists/oss-security/2026/07/09/4 PACKAGE: https://github.com/python/cpython
	Under investigation	CVE-2026-41992	gzip	1.14	High: 7.5	last month
Summary GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Via base gzip Affected ranges 1.14 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
	Under investigation	BIT-libpython-2026-11972 BIT-python-2026-11972 BIT-python-min-2026-11972 PSF-2026-31 CVE-2026-11972	python	3.14.4 – 3.14.6	High	last month
Summary tarfile opened in streaming mode mishandles EOF Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11972.json, https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/, https://nvd.nist.gov/vuln/detail/CVE-2026-11972 Fix: https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9, https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365, https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21, https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec, https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192 +2 more Report: https://github.com/python/cpython/issues/151981 PACKAGE: https://github.com/python/cpython
	Under investigation	BIT-libpython-2026-11940 BIT-python-2026-11940 BIT-python-min-2026-11940 PSF-2026-30 CVE-2026-11940	python	3.14.4 – 3.14.6	High	last month
Summary tarfile extraction filter bypass allows escaping the destination directory Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11940.json, https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/, https://nvd.nist.gov/vuln/detail/CVE-2026-11940 Fix: https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f, https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df, https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde, https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c, https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9 +1 more Report: https://github.com/python/cpython/issues/151558 PACKAGE: https://github.com/python/cpython
	Under investigation	CVE-2026-5435	glibc	2.42 – 2.44	High: 7.3	3 months ago
Summary The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. Via glibc Affected ranges 2.42 – 2.44 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
	Under investigation	OSV-2026-343	pcre2	10.45 – 10.47	High	5 months ago
Summary Heap-buffer-overflow in pcre2_compile_32 Via base grep pcre2 Affected ranges 10.45 – 10.47 References Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488713937
Medium (6)
	Status	IDs	Package	Version	Severity	Published
	Under investigation	CVE-2026-41991	gzip	1.14	Medium: 4.7	last month
Summary GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Via base gzip Affected ranges 1.14 CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
	Under investigation	BIT-libpython-2026-0864 BIT-python-2026-0864 BIT-python-min-2026-0864 PSF-2026-29 CVE-2026-0864	python	3.14.4 – 3.14.6	Medium	last month
Summary Configuration Injection via Carriage Return (\r) in write() method Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0864.json, https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/, https://nvd.nist.gov/vuln/detail/CVE-2026-0864 Fix: https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528, https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f, https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98, https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8, https://github.com/python/cpython/pull/151559 Report: https://github.com/python/cpython/issues/143927 PACKAGE: https://github.com/python/cpython
	Under investigation	BIT-libpython-2026-12003 BIT-python-2026-12003 BIT-python-min-2026-12003 PSF-2026-28 CVE-2026-12003	python	3.14.4 – 3.14.6	Medium	last month
Summary CPython >3.11 Insecure Input Validation resulting in privilege escalation Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12003.json, https://https://mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH/, https://nvd.nist.gov/vuln/detail/CVE-2026-12003 Fix: https://github.com/python/cpython/commit/16c40f944b7bff724a403cf4902763d095bb4b2a, https://github.com/python/cpython/commit/9e863fab283eddca9c2a8f9d1ee30f4dc243e314, https://github.com/python/cpython/commit/a86de0bc236fbb9452f98998fc8437e9fca35700, https://github.com/python/cpython/commit/b93d6d3399adbd3a5037b6b92fc3587c85ac5d56, https://github.com/python/cpython/pull/151545 Report: https://github.com/python/cpython/issues/151544 Web: http://www.openwall.com/lists/oss-security/2026/06/16/8 PACKAGE: https://github.com/python/cpython
	Under investigation	CVE-2026-6238	glibc	2.42 – 2.44	Medium: 6.5	3 months ago
Summary The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. Via glibc Affected ranges 2.42 – 2.44 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
	Under investigation	BIT-libpython-2025-15367 BIT-python-2025-15367 BIT-python-min-2025-15367 PSF-2026-4 CVE-2025-15367	python	3.14.4 – 3.14.6	Medium	6 months ago
Summary POP3 command injection in user-controlled commands Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15367.json, https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/, https://nvd.nist.gov/vuln/detail/CVE-2025-15367 Fix: https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7, https://github.com/python/cpython/pull/143924 Report: https://github.com/python/cpython/issues/143923 PACKAGE: https://github.com/python/cpython
	Under investigation	BIT-libpython-2025-15366 BIT-python-2025-15366 BIT-python-min-2025-15366 PSF-2026-3 CVE-2025-15366	python	3.14.4 – 3.14.6	Medium	6 months ago
Summary IMAP command injection in user-controlled commands Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15366.json, https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/, https://nvd.nist.gov/vuln/detail/CVE-2025-15366 Fix: https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1, https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45, https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2, https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d, https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a +1 more Report: https://github.com/python/cpython/issues/143921 PACKAGE: https://github.com/python/cpython
Low (1)
	Status	IDs	Package	Version	Severity	Published
	Under investigation	BIT-libpython-2026-4360 BIT-python-2026-4360 BIT-python-min-2026-4360 PSF-2026-32 CVE-2026-4360	python	3.14.4 – 3.14.6	Low	last month
Summary Tarfile.extract() doesn't fully respect filter parameter Via python Affected ranges 3.14.4 – 3.14.6 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4360.json, https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/, https://nvd.nist.gov/vuln/detail/CVE-2026-4360 Fix: https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0, https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301, https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a, https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f, https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44 +2 more Report: https://github.com/python/cpython/issues/151987 PACKAGE: https://github.com/python/cpython
Unknown (2)
	Status	IDs	Package	Version	Severity	Published
	Under investigation	GHSA-q7rw-r7qq-2hx6	pcre2	10.45 – 10.47	Unknown	9 months ago
Summary pcre2_serialize_encode() information disclosure Via base grep pcre2 Affected ranges 10.45 – 10.47 References Web: https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6
	Resolved in 1fc9175166fc5c5117838a1dcfb309b7c595eb56	OSV-2023-505	file	1fc9175166fc5c5117838a1dcfb309b7c595eb56, fixed in 1fc9175166fc5c5117838a1dcfb309b7c595eb56	Unknown	3 years ago
Summary UNKNOWN WRITE in regcomp Via base file Affected ranges 1fc9175166fc5c5117838a1dcfb309b7c595eb56, fixed in 1fc9175166fc5c5117838a1dcfb309b7c595eb56 Fixed in 1fc9175166fc5c5117838a1dcfb309b7c595eb56 References Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60010

44 components

Software Bill of Materials — every package this build depends on
Packages	Version	Repository	Licence
gcloudROOT	577.0.0	https://storage.googleapis.com/cloud-sdk-release/google-cloud-cli-577.0.0-linux-x86_64.tar.gz	(Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND MIT-0 AND Python-2.0)
aclROOT	2.4.0	https://storage.googleapis.com/minimal-staging-archives/acl-2.4.0.tar.xzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
attrROOT	2.6.0	https://storage.googleapis.com/minimal-staging-archives/attr-2.6.0.tar.gzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
bash	5.3	www.gnu.org/software/bash	GPL-3.0-only
bash-bootstrap	5.3	www.gnu.org/software/bash	GPL-3.0-only
binutils	2.47	www.gnu.org/software/binutils	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.0-only)
bison	3.8.2	www.gnu.org/software/bison	GPL-3.0-only
bzip2	1.0.8	github.com/libarchive/bzip2	bzip2-1.0.6
coreutils	9.11	www.gnu.org/software/coreutils	GPL-3.0-only
diffutils	3.12	www.gnu.org/software/diffutils	GPL-3.0-only
expat	2.8.2	github.com/libexpat/libexpat	MIT
fileROOT	5.48	https://storage.googleapis.com/minimal-staging-archives/file-5.48.tar.gzMIRROR	BSD-2-Clause-Darwin
findutils	4.11.0	www.gnu.org/software/findutils	GPL-3.0-only
flex	2.6.4	github.com/westes/flex	BSD-3-Clause-flex
gawk	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gawk-bootstrap	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gcc	15.2.0	www.gnu.org/software/gcc	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
gdbm	1.26	www.gnu.org/software/gdbm	GPL-3.0-only
glibc	2.44	www.gnu.org/software/glibc	(GPL-2.0-only AND LGPL-2.1-only)
gmp	6.3.0	www.gnu.org/software/gmp	LGPL-3.0-or-later OR GPL-2.0-or-later
grep	3.12	www.gnu.org/software/grep	GPL-3.0-only
gzip	1.14	www.gnu.org/software/gzip	GPL-3.0-only
libcapROOT	2.78	https://storage.googleapis.com/minimal-staging-archives/libcap-2.78.tar.xzMIRROR	BSD-3-Clause OR GPL-2.0-only
libffi	3.7.1	github.com/libffi/libffi	MIT
linux_headers	6.12.43	github.com/torvalds/linux	GPL-2.0-only WITH Linux-syscall-note
lz4	1.10.0	github.com/lz4/lz4	BSD-2-Clause AND GPL-2.0-or-later
m4	1.4.21	www.gnu.org/software/m4	GPL-3.0-only
make	4.4.1	www.gnu.org/software/make	GPL-3.0-only
mpc	1.4.1	www.gnu.org/software/mpc	LGPL-3.0-or-later
mpfr	4.2.2	www.gnu.org/software/mpfr	GPL-3.0-only
ncurses	6.6	www.gnu.org/software/ncurses	X11-distribute-modifications-variant
openssl	3.6.3	github.com/openssl/openssl	Apache-2.0
pcre2	10.47	github.com/PCRE2Project/pcre2	BSD-3-Clause WITH PCRE2-exception
perl	5.44.0	github.com/Perl/perl5	Artistic-1.0-Perl OR GPL-1.0-or-later
pkgconf	3.0.4	github.com/pkgconf/pkgconf	ISC
python	3.14.6	github.com/python/cpython	Python-2.0.1
readline	8.3	www.gnu.org/software/readline	GPL-3.0-only
sed	4.10	www.gnu.org/software/sed	GPL-3.0-only
sqlite	3.53.3	github.com/sqlite/sqlite	blessing
tar	1.35	www.gnu.org/software/tar	GPL-3.0-only
util-linux	2.42.2	github.com/util-linux/util-linux	GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause
xz	5.8.3	github.com/tukaani-project/xz	(0BSD AND GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
zlib	1.3.2	github.com/madler/zlib	Zlib
zstd	1.5.7	github.com/facebook/zstd	BSD-3-Clause OR GPL-2.0-only

gcloud

Install package

What is "gcloud"?

How to use this package

Quick install

Declare as a task dependency in minimal.toml

Build-time vs runtime

Dependencies (3)

Dependency changes

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

CVSS vector

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

CVSS vector

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

CVSS vector

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

CVSS vector

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

Fixed in

References

44 components