CVE-2025-9810CWE-367

TOCTOU race in Linenoise enables arbitrary file overwrite and permission changes

Medium · published September 1, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

TOCTOU  in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00107 · 1.1th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2025-09-01T19:03Z
EPSS history
Timeline
  • 01 SEP 19:03Z
    TOCTOU race in Linenoise enables arbitrary file overwrite and permission changes
    cvelistv5