[alexzenla]

Hi! I’m the CTO of Edera and discovered this bug with my colleague Steven!

The story of this bug is interesting. We were both up late at night working on GPU support on the Edera platform, and we had just pulled an NVIDIA container image. What should have resulted in a temporary directory of tar files for OCI layers was filled with NVIDIA library files! We were both super confused until I had an “oh god no” moment and realized this happened.

We kicked right into action on responsible disclosure.

I can answer any questions, but I want to send a huge thank you to our team for working together on this and to Astral for being wonderful to work with!