{"id":"CVE-2025-54867","published":"2025-08-14T16:08:00Z","modified":"2025-08-14T19:26:11Z","title":"Youki Symlink Following Vulnerability","vendor":"youki-dev","product":"youki","tier":"tail","description":{"text":"Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.","provenance":"source","from":"CVE.org"},"cvss":{"score":7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00183,"percentile":0.0786,"provenance":"source"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"}],"references":[{"url":"https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37","tags":["x_refsource_MISC"]},{"url":"https://github.com/youki-dev/youki/releases/tag/v0.5.5","tags":["x_refsource_MISC"]}],"priority":{"score":6.5,"factors":[{"name":"EPSS percentile","points":1.57},{"name":"CVSS severity","points":4.9}]},"vendorSlug":"youki-dev","affectedVersions":[{"vendor":"youki-dev","product":"youki","versions":["< 0.5.5"]}],"affected":[{"ecosystem":"crates.io","package":"youki","vulnerableRanges":["<0.5.5"],"patched":["0.5.5"],"from":["GHSA-j26p-6wx7-f3pw"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-24859","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","packageHistory":[{"cve":"CVE-2025-54867","published":"2025-08-14","fixed":"0.5.5","kev":false},{"cve":"CVE-2025-62161","published":"2025-11-05","fixed":"0.5.7","kev":false,"link":{"from":"CVE-2025-54867","to":"CVE-2025-62161","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"crates.io:youki","fromFixed":"0.5.5","toFixed":"0.5.7","daysApart":83},{"kind":"similar","provenance":"machine","score":0.47,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2025-62596","published":"2025-11-05","fixed":"0.5.7","kev":false,"link":{"from":"CVE-2025-54867","to":"CVE-2025-62596","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"crates.io:youki","fromFixed":"0.5.5","toFixed":"0.5.7","daysApart":83},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same product + CWE + description similarity"}]}}],"package":"crates.io:youki"}}