# CRI-O v1.35.7

> Kubernetes Core · 2026-08-24

A security maintenance release fixes a vulnerability involving newline handling in the `HOME` environment variable. The fix addresses a bypass that could allow `/etc/passwd` injection.

## Action needed
- **[security · high]** `CVE-2026-15809` newline handling in `HOME`
  - Fixes `CVE-2026-15809`, which allowed `/etc/passwd` injection through newline characters in the `HOME` environment variable. The check now matches actual newline bytes instead of the literal string `"\n"`.

[Full analysis](https://ratatosk.io/en/releases/cri-o/v1.35.7)

[Original release notes](https://github.com/cri-o/cri-o/releases/tag/v1.35.7)