The vulnerability in tookie-osint versions before 4.1fix involves improper limitation of pathname to a restricted directory (CWE-22). Specifically, the write_txt, write_csv, write_json, and scan_file helper functions open output files using a filename derived directly from unsanitized user input (the -u CLI flag or usernames file). This allows path traversal sequences such as '..', '/', or '\' to influence the output path, enabling writing files outside the intended directory to any location writable by the user. This issue is fixed in version 4.1fix.

An attacker who can control the username input can cause tookie-osint to write output files to arbitrary paths on the filesystem where the invoking user has write permissions. This could lead to overwriting or creating files in unintended locations, potentially enabling privilege escalation or data manipulation depending on the environment and user privileges. There are no known exploits in the wild at this time.

Upgrade tookie-osint to version 4.1fix or later, where this path traversal vulnerability has been fixed. Until upgrading, avoid running the tool with untrusted or unsanitized username inputs that contain path traversal characters. Patch status is not explicitly confirmed beyond the mention of the fix in 4.1fix; verify with the vendor for official advisories and updates.