CVE-2026-49134

Katalog CVE

CVSS 7.1 · High EPSS 0,48%

Kerentanan Insecure Temporary File. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.

Rincian

Terbit di NVD

1 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-377: Insecure Temporary File

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/steipete/CodexBar/commit/dbc944d46cd4cf7877d1ca47c44556fe573b46e8
• https://github.com/steipete/CodexBar/pull/1222
• https://github.com/steipete/CodexBar/releases/tag/v0.32.0
• https://www.vulncheck.com/advisories/codexbar-privilege-escalation-via-cli-installer-temp-file