PT-2025-45167 · Youki · Youki

Published 2025-11-05 · Updated 2025-11-11 · CVE-2025-62596

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Youki versions 0.5.6 and below

Description Youki, a container runtime written in Rust, has an issue with its apparmor handling. Insufficiently strict write-target validation, combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. A shared-mount race can substitute intermediate path components, redirecting the final target during path resolution.

Recommendations Update to Youki version 0.5.7 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-61

CWE-363

Related Identifiers

CVE-2025-62596

GHSA-VF95-55W6-QMRF

Affected Products

Youki

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62596.json · Exploit
• https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a · Patch
• https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf95-55w6-qmrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62596 · Security Note
• https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm · Note
• https://github.com/youki-dev/youki · Note
• https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs · Note
• https://youtu.be/y1PaBzxwRWQ · Note
• https://reddit.com/r/VulnMatter/comments/1oq8naq/resumen_diario_de_vulnerabilidades_06112025 · Reddit Post
• https://youtu.be/tGseJW_uBB8 · Note
• https://reddit.com/r/VulnMatter/comments/1otcofi/resumen_diario_de_vulnerabilidades_10112025 · Reddit Post
• https://twitter.com/cracbot/status/1988200070387560698 · Twitter Post
• https://t.me/CVEtracker/36653 · Telegram Post