Threats tagged 'bit-libpython-2026-12345'

A race condition vulnerability exists in the cleanup process of tempfile.TemporaryDirectory in libpython. An attacker able to modify the directory tree during cleanup can replace a directory with a symbolic link, leading to deletion or permission changes of files outside the intended temporary directory. This occurs with the privileges of the process performing the cleanup. Platforms where shutil.rmtree.avoids_symlink_attacks is false remain vulnerable, and file flags may be reset outside the temporary directory on all platforms.