CVE-2025-62596

Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a	Patch
https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf	Vendor Advisory
https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs	Not Applicable
https://youtu.be/tGseJW_uBB8	Not Applicable
https://youtu.be/y1PaBzxwRWQ	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:youki-dev:youki:*:*:*:*:*:rust:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Youki es un runtime de contenedores escrito en Rust. En las versiones 0.5.6 e inferiores, el manejo de apparmor de Youki realiza una validación de destino de escritura insuficientemente estricta y, cuando se combina con la sustitución de rutas durante la resolución de nombres de ruta, puede permitir escrituras en ubicaciones de procfs no intencionadas. Mientras se resuelve una ruta componente por componente, una condición de carrera de montaje compartido puede sustituir componentes intermedios y redirigir el destino final. Este problema está corregido en la versión 0.5.7.

Information

Published : 2025-11-06 00:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-62596

Mitre link : CVE-2025-62596

CVE.ORG link : CVE-2025-62596

JSON object : View

Products Affected

youki-dev

youki

CWE

CWE-61

UNIX Symbolic Link (Symlink) Following

CWE-363

Race Condition Enabling Link Following

{"id": "CVE-2025-62596", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62596", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-06T16:54:08.273724Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "youki-dev", "product": "youki", "versions": [{"status": "affected", "version": "< 0.5.7"}]}]}], "published": "2025-11-06T00:15:37.817", "references": [{"url": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://youtu.be/tGseJW_uBB8", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://youtu.be/y1PaBzxwRWQ", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-61"}, {"lang": "en", "value": "CWE-363"}]}], "descriptions": [{"lang": "en", "value": "Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki\u2019s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7."}, {"lang": "es", "value": "Youki es un runtime de contenedores escrito en Rust. En las versiones 0.5.6 e inferiores, el manejo de apparmor de Youki realiza una validaci\u00f3n de destino de escritura insuficientemente estricta y, cuando se combina con la sustituci\u00f3n de rutas durante la resoluci\u00f3n de nombres de ruta, puede permitir escrituras en ubicaciones de procfs no intencionadas. Mientras se resuelve una ruta componente por componente, una condici\u00f3n de carrera de montaje compartido puede sustituir componentes intermedios y redirigir el destino final. Este problema est\u00e1 corregido en la versi\u00f3n 0.5.7."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:youki-dev:youki:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "8ABEC689-758E-4D49-AFC4-6C640532D120", "versionEndExcluding": "0.5.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}