Packer CVEs and Security Vulnerabilities

CVE-2026-19589

Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Packer

CVE-2018-15869

awscli: Allows loading of an undesired AMI by setting similar image properties

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

CVSS 3.0 · 5.3 Medium EPSS 1.8% KEV · Not listed