chore(deps): update module github.com/docker/cli to v29 [security] (release-1.15)

[phisco-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/docker/cli	v24.0.7+incompatible → v29.2.0+incompatible

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows

CVE-2025-15558 / GHSA-p436-gjf2-799p

More information

Details

This issue affects Docker CLI through 29.1.5

Impact

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI through v29.1.5 (fixed in v29.2.0). It impacts Windows binaries acting as a CLI plugin manager via the github.com/docker/cli/cli-plugins/manager package, which is consumed by downstream projects such as Docker Compose.

Docker Compose became affected starting in v2.31.0, when it incorporated the relevant CLI plugin manager code (see https://github.com/docker/compose/pull/12300), and is fixed in v5.1.0.

This issue does not impact non-Windows binaries or projects that do not use the plugin manager code.

Patches

Fixed version starts with 29.2.0

This issue was fixed in docker/cli@1375933 (https://github.com/docker/cli/pull/6713), which removed %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for plugin-discovery on Windows.

Workarounds

None

Resources

• Pull request: "cli-plugins/manager: remove legacy system-wide cli-plugin path" (https://github.com/docker/cli/pull/6713)
• Patch: https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa.patch

Credits

Nitesh Surana (niteshsurana.com) of Trend Research of TrendAI

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p
• https://nvd.nist.gov/vuln/detail/CVE-2025-15558
• https://github.com/docker/cli/pull/6713
• https://github.com/docker/compose/pull/12300
• https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa
• https://docs.docker.com/desktop/release-notes
• https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304
• https://github.com/advisories/GHSA-p436-gjf2-799p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

BIT-docker-cli-2025-15558 / CVE-2025-15558 / GHSA-p436-gjf2-799p / GO-2026-4610

More information

Details

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

Severity

Unknown

References

• https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p
• https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa
• https://github.com/docker/cli/pull/6713
• https://github.com/docker/compose/pull/12300
• https://docs.docker.com/desktop/release-notes
• https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

docker/cli (github.com/docker/cli)

v29.2.0+incompatible

Compare Source

v29.1.5+incompatible

Compare Source

v29.1.4+incompatible

Compare Source

v29.1.3+incompatible

Compare Source

v29.1.2+incompatible

Compare Source

v29.1.1+incompatible

Compare Source

v29.1.0+incompatible

Compare Source

v29.0.4+incompatible

Compare Source

v29.0.3+incompatible

Compare Source

v29.0.2+incompatible

Compare Source

v29.0.1+incompatible

Compare Source

v29.0.0+incompatible

Compare Source

v28.5.2+incompatible

Compare Source

v28.5.1+incompatible

Compare Source

v28.5.0+incompatible

Compare Source

v28.4.0+incompatible

Compare Source

v28.3.3+incompatible

Compare Source

v28.3.2+incompatible

Compare Source

v28.3.1+incompatible

Compare Source

v28.3.0+incompatible

Compare Source

v28.2.2+incompatible

Compare Source

v28.2.1+incompatible

Compare Source

v28.2.0+incompatible

Compare Source

v28.1.1+incompatible

Compare Source

v28.1.0+incompatible

Compare Source

v28.0.4+incompatible

Compare Source

v28.0.3+incompatible

Compare Source

v28.0.2+incompatible

Compare Source

v28.0.1+incompatible

Compare Source

v28.0.0+incompatible

Compare Source

v27.5.1+incompatible

Compare Source

v27.5.0+incompatible

Compare Source

v27.4.1+incompatible

Compare Source

v27.4.0+incompatible

Compare Source

v27.3.1+incompatible

Compare Source

v27.3.0+incompatible

Compare Source

v27.2.1+incompatible

Compare Source

v27.2.0+incompatible

Compare Source

v27.1.2+incompatible

Compare Source

v27.1.1+incompatible

Compare Source

v27.1.0+incompatible

Compare Source

v27.0.3+incompatible

Compare Source

v27.0.2+incompatible

Compare Source

v27.0.1+incompatible

Compare Source

v26.1.5+incompatible

Compare Source

v26.1.4+incompatible

Compare Source

v26.1.3+incompatible

Compare Source

v26.1.2+incompatible

Compare Source

v26.1.1+incompatible

Compare Source

v26.1.0+incompatible

Compare Source

v26.0.2+incompatible

Compare Source

v26.0.1+incompatible

Compare Source

v26.0.0+incompatible

Compare Source

v25.0.7+incompatible

Compare Source

v25.0.6+incompatible

Compare Source

v25.0.5+incompatible

Compare Source

v25.0.4+incompatible

Compare Source

v25.0.3+incompatible

Compare Source

v25.0.2+incompatible

Compare Source

v25.0.1+incompatible

Compare Source

v25.0.0+incompatible

Compare Source

v24.0.9+incompatible

Compare Source

v24.0.8+incompatible

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[phisco-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod

Command failed: install-tool golang $(grep -oP ^toolchain go\K.+ go.mod)

File name: go.mod

Command failed: make generate
github.com/docker/cli/cli/config/memorystore: build constraints exclude all Go files in /home/ubuntu/go/pkg/mod/github.com/docker/cli@v29.2.0+incompatible/cli/config/memorystore
apis/generate.go:73: running "go": exit status 1
make[1]: *** [build/makelib/golang.mk:240: go.generate] Error 1
make: *** [build/makelib/common.mk:434: generate] Error 2