CVE-2025-9810

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-9810
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-9810
Published
2025-09-01T19:03:19Z
Modified
2026-08-12T15:31:10Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
TOCTOU race in Linenoise enables arbitrary file overwrite and permission changes
Details

TOCTOU  in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path.

Database specific 
{
    "cna_assigner": "CyberArk",
    "cwe_ids": [
        "CWE-367"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9810.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/antirez/linenoise

Affected ranges

Type
GIT
Repo
https://github.com/antirez/linenoise
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f2558e1e588b1ba384ec73a2cf5c9a46409753db
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

1.*
1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9810.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265348205535378370319795114444392726630",
                "273281227715678456856085506334798903171",
                "34349218758613275275793102682184965558",
                "220831549205519235080045685807123472005"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-9810-5a66a9a5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/antirez/linenoise/commit/f2558e1e588b1ba384ec73a2cf5c9a46409753db",
        "target": {
            "file": "linenoise.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "239340519119530426938189686411231833220",
            "length": 369
        },
        "id": "CVE-2025-9810-c54a8de3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/antirez/linenoise/commit/f2558e1e588b1ba384ec73a2cf5c9a46409753db",
        "target": {
            "file": "linenoise.c",
            "function": "linenoiseHistorySave"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:31:10Z"