GNU Sed versions prior to 4.10 contain a time-of-check to time-of-use (TOCTOU) race condition when invoked with -i and --follow-symlinks. The function open_next_file() first resolves the symlink target path and then opens the original symlink path to read the file, with a window between these operations. An attacker can exploit this race window by atomically swapping the symlink target, causing sed to read from one file but write output to a different, attacker-controlled file path. This can lead to arbitrary file overwrite under the privileges of the sed process. The vulnerability is tracked as CWE-367 and has a CVSS 4.0 score of 2.1 (low severity).

An attacker able to manipulate symlinks accessible to the sed process can exploit this race condition to overwrite arbitrary files with attacker-controlled content. This could lead to unauthorized file modification or corruption. However, the impact is limited by the local access required to manipulate symlinks and the low CVSS score reflects the limited attack surface and complexity.

This vulnerability is fixed in GNU Sed version 4.10. Users and administrators should upgrade to version 4.10 or later to remediate this issue. No official patch or temporary fix is indicated in the advisory, so upgrading is the recommended remediation. Until upgraded, avoid using sed with both -i and --follow-symlinks options on untrusted symlinks to reduce risk.