CVE-2025-9810mediumCWE-367

TOCTOU race in Linenoise enables arbitrary file overwrite and permission changes

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.1%

probabilidade de exploração

0.1%top 99% das CVEs

exploração observada

nãonenhuma fonte reporta

TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Produtos afetados

antirez · linenoise

Referências

https://github.com/antirez/linenoise/blob/4111f1d6cd29e136b4e86a25d1dd859a1e00813b/linenoise.c#L1321 https://github.com/antirez/linenoise/blob/master/linenoise.c#L1321 https://github.com/antirez/linenoise/commit/f2558e1e588b1ba384ec73a2cf5c9a46409753db https://github.com/antirez/linenoise/pull/202