PYSEC-2026-1845
pytest has vulnerable tmpdir handling
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-71176
- Alias
- GHSA-6w46-j5rx-g56g
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Description
pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · pytest | introduced 0, fixed 9.0.3 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2025-71176 ADVISORY
- https://github.com/pytest-dev/pytest/issues/13669 WEB
- https://github.com/pytest-dev/pytest/pull/14343 WEB
- https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c WEB
- https://github.com/pytest-dev/pytes PACKAGE
- https://github.com/pytest-dev/pytest/releases/tag/9.0.3 WEB
- https://www.openwall.com/lists/oss-security/2026/01/21/5 WEB
- https://pypi.org/project/pytest PACKAGE
- https://github.com/advisories/GHSA-6w46-j5rx-g56g ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |