CVE-2026-49134CWE-377

CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File

High · published June 1, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-377 · Insecure Temporary File
Published
2026-06-01T18:53Z
EPSS history
Timeline
  • 01 JUN 18:53Z
    CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File
    cvelistv5