A critical container escape vulnerability (CVE-2025-62161) affects youki versions prior to 0.5.7. The flaw arises from improper validation and a race condition when bind mounting the container's /dev/null as a file mask. This allows an attacker to replace /dev/null with a symbolic link, enabling bind-mounting of arbitrary host files into the container. The issue is similar to a previously disclosed vulnerability in runc. A fix is available in youki version 0.5.7.