#397 HIGH: Predictable /tmp file path TOCTOU vulnerability in async_deferred_task

closed high Created 2025-12-11 22:44 · Updated 2025-12-11 22:50

Description

Edit
async_deferred_task.py:103-105 - Creates predictable /tmp/highway_job_{job_id}.py file path. Attacker could create symlink at this path before file write, potentially writing arbitrary content to attacker-controlled location. Fix: Use tempfile.mkstemp() with unpredictable name, or write to secure directory with restricted permissions.

Comments

Loading comments...

Context

Loading context...

Audit History

View All
Loading audit history...