Threats tagged 'bit-python-2026-12345'

A race condition vulnerability exists in Python's tempfile.TemporaryDirectory cleanup process. An attacker able to modify the directory tree during cleanup can replace a directory with a symbolic link, leading to deletion or permission changes of files outside the intended temporary directory. This occurs with the privileges of the cleanup process. Systems where shutil.rmtree.avoids_symlink_attacks is false remain vulnerable, and file flags may be reset outside the temporary directory on all platforms.