CVE-2025-62161 — UNIX Symbolic Link (Symlink) Following in Youki

CWE-61 — UNIX Symbolic Link (Symlink) FollowingCWE-363 — Race Condition Enabling Link Following4 documents4 sources
Severity
7.3HIGHNVD
EPSS
0.0%
top 85.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Youki-dev Youki
Timeline
Latest updateNov 5
PublishedNov 6

Description

Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages3 packages

▶CVEListV5youki-dev/youki< 0.5.7
▶NVDyouki-dev/youki< 0.5.7
▶crates.ioyouki-dev/youki< 0.5.7

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
youki container escape via "masked path" abuse due to mount race conditions↗2025-11-05
▶
OSV
youki container escape via "masked path" abuse due to mount race conditions↗2025-11-05
▶
CVEList
youki container escape via "masked path" abuse due to mount race conditions↗2025-11-05
▶
CVE-2025-62161 — UNIX Symbolic Link (Symlink) Following | cvebase