GHSA-m65q-v92h-cm7q

Source

https://github.com/advisories/GHSA-m65q-v92h-cm7q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-m65q-v92h-cm7q/GHSA-m65q-v92h-cm7q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m65q-v92h-cm7q

Aliases

CVE-2025-5791

Published

2025-06-05T01:17:28Z

Modified

2025-06-06T23:44:35.013779Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

users may append `root` to group listings

Details

Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.

This affects both:

The supplementary groups of a user
The group access list of the current process

If the caller uses this information for access control, this may lead to privilege escalation.

This crate is not currently maintained, so a patched version is not available.

Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.

Recommended alternatives

uzers (an actively maintained fork of the users crate)
sysinfo

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-266"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-05T01:17:28Z"
}

References

Affected packages

crates.io / users

Package

Name: users; View open source insights on deps.dev
Purl: pkg:cargo/users

Affected ranges

Type: SEMVER
Events: Introduced

0.8.0

Last affected

0.11.0