The vulnerability CVE-2025-5962 in Red Hat Enterprise Linux 10's Lightspeed history service arises from insufficient access controls. A local attacker without privileges can exploit inter-process communication to manipulate chat history entries of other users, including viewing, deleting, or injecting malicious commands. This can lead to social engineering attacks that may cause unauthorized command execution or privilege misuse. The CVSS v3.1 base score is 7.7 (high), reflecting high confidentiality and integrity impact with no required user interaction. The issue is addressed by updates to the command-line-assistant package as per Red Hat's security advisory RHSA-2025:16345. Affected versions are >=10.0 and <10.3. The vendor advisory recommends applying the update after ensuring all prior errata are applied.

A local, unprivileged user can access and manipulate another user's chat history, potentially injecting misleading or malicious commands. This can deceive users into executing harmful actions, leading to unauthorized command execution or privilege misuse. The confidentiality and integrity of user data are highly impacted, but availability is not affected. There are no known exploits in the wild at this time.

Red Hat has released updated packages for the command-line-assistant to fix this vulnerability. Administrators should apply the security update RHSA-2025:16345 for Red Hat Enterprise Linux 10, ensuring all previously released errata are applied beforehand. No other mitigations or workarounds are specified by the vendor.