CVE-2025-62596
criticalYouki is a container runtime written in Rust.
Vendor / product: Youki-dev — youki
Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.
CVSS
10.0
10.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-11-06 00:15
Modified: 2026-10-19 13:10
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
youki-dev / youki <0.5.7
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a security-advisories@github.com
- https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf security-advisories@github.com
- https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs security-advisories@github.com
- https://youtu.be/tGseJW_uBB8 security-advisories@github.com
- https://youtu.be/y1PaBzxwRWQ security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗