Refine your search
5 vulnerabilities found for youki by youki-dev
CVE-2025-62596 (GCVE-0-2025-62596)
Vulnerability from nvd
Published
2025-11-05 23:14
Modified
2025-11-06 16:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-06T16:54:08.273724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-06T16:54:15.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "youki",
"vendor": "youki-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki\u2019s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-363",
"description": "CWE-363: Race Condition Enabling Link Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T23:14:37.167Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf"
},
{
"name": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a"
},
{
"name": "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs",
"tags": [
"x_refsource_MISC"
],
"url": "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs"
},
{
"name": "https://youtu.be/tGseJW_uBB8",
"tags": [
"x_refsource_MISC"
],
"url": "https://youtu.be/tGseJW_uBB8"
},
{
"name": "https://youtu.be/y1PaBzxwRWQ",
"tags": [
"x_refsource_MISC"
],
"url": "https://youtu.be/y1PaBzxwRWQ"
}
],
"source": {
"advisory": "GHSA-vf95-55w6-qmrf",
"discovery": "UNKNOWN"
},
"title": "youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62596",
"datePublished": "2025-11-05T23:14:37.167Z",
"dateReserved": "2025-10-16T19:24:37.266Z",
"dateUpdated": "2025-11-06T16:54:15.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-62161 (GCVE-0-2025-62161)
Vulnerability from nvd
Published
2025-11-05 23:09
Modified
2025-11-06 21:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62161",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-06T21:20:10.358215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-06T21:20:19.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "youki",
"vendor": "youki-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container\u0027s /dev/null as a file mask. This issue is fixed in version 0.5.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-363",
"description": "CWE-363: Race Condition Enabling Link Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T23:09:09.014Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8"
},
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8"
},
{
"name": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a"
}
],
"source": {
"advisory": "GHSA-4g74-7cff-xcv8",
"discovery": "UNKNOWN"
},
"title": "youki container escape via \"masked path\" abuse due to mount race conditions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62161",
"datePublished": "2025-11-05T23:09:09.014Z",
"dateReserved": "2025-10-07T16:12:03.424Z",
"dateUpdated": "2025-11-06T21:20:19.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-54867 (GCVE-0-2025-54867)
Vulnerability from nvd
Published
2025-08-14 16:08
Modified
2025-08-14 19:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-61 - UNIX Symbolic Link (Symlink) Following
Summary
Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T18:43:03.915598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T19:26:11.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "youki",
"vendor": "youki-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T16:08:00.622Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw"
},
{
"name": "https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37"
},
{
"name": "https://github.com/youki-dev/youki/releases/tag/v0.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/releases/tag/v0.5.5"
}
],
"source": {
"advisory": "GHSA-j26p-6wx7-f3pw",
"discovery": "UNKNOWN"
},
"title": "Youki Symlink Following Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-54867",
"datePublished": "2025-08-14T16:08:00.622Z",
"dateReserved": "2025-07-31T17:23:33.472Z",
"dateUpdated": "2025-08-14T19:26:11.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-62596 (GCVE-0-2025-62596)
Vulnerability from cvelistv5
Published
2025-11-05 23:14
Modified
2025-11-06 16:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-06T16:54:08.273724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-06T16:54:15.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "youki",
"vendor": "youki-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki\u2019s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-363",
"description": "CWE-363: Race Condition Enabling Link Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T23:14:37.167Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf"
},
{
"name": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a"
},
{
"name": "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs",
"tags": [
"x_refsource_MISC"
],
"url": "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs"
},
{
"name": "https://youtu.be/tGseJW_uBB8",
"tags": [
"x_refsource_MISC"
],
"url": "https://youtu.be/tGseJW_uBB8"
},
{
"name": "https://youtu.be/y1PaBzxwRWQ",
"tags": [
"x_refsource_MISC"
],
"url": "https://youtu.be/y1PaBzxwRWQ"
}
],
"source": {
"advisory": "GHSA-vf95-55w6-qmrf",
"discovery": "UNKNOWN"
},
"title": "youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62596",
"datePublished": "2025-11-05T23:14:37.167Z",
"dateReserved": "2025-10-16T19:24:37.266Z",
"dateUpdated": "2025-11-06T16:54:15.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-62161 (GCVE-0-2025-62161)
Vulnerability from cvelistv5
Published
2025-11-05 23:09
Modified
2025-11-06 21:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62161",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-06T21:20:10.358215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-06T21:20:19.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "youki",
"vendor": "youki-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container\u0027s /dev/null as a file mask. This issue is fixed in version 0.5.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-363",
"description": "CWE-363: Race Condition Enabling Link Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T23:09:09.014Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8"
},
{
"name": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8"
},
{
"name": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a"
}
],
"source": {
"advisory": "GHSA-4g74-7cff-xcv8",
"discovery": "UNKNOWN"
},
"title": "youki container escape via \"masked path\" abuse due to mount race conditions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62161",
"datePublished": "2025-11-05T23:09:09.014Z",
"dateReserved": "2025-10-07T16:12:03.424Z",
"dateUpdated": "2025-11-06T21:20:19.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}