GHSA-qwcc-2r77-5w2f
Medium · 6.5CVSS
6.5
EPSS
—
Published
Dec 10, 2025
CISA due date
—
The record
sd changes the group ownership of the source file
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | sd | 0 | No fix |
Related vulnerabilities
- CVE-2025-65807 An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root… Same vulnerability
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-266
- CVE-2026-62106 Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions. CWE-266
- CVE-2026-62102 Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions. CWE-266
- CVE-2026-8303 Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies… CWE-266
- CVE-2026-81805 Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. CWE-266
- CVE-2026-15140 A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift… CWE-266
- CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-266