{"id":"CVE-2025-62161","published":"2025-11-05T23:09:09Z","modified":"2025-11-06T21:20:19Z","title":"youki container escape via \"masked path\" abuse due to mount race conditions","vendor":"youki-dev","product":"youki","tier":"tail","description":{"text":"Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00259,"percentile":0.17657,"provenance":"source"},"cwes":[{"id":"CWE-363","name":"Race Condition Enabling Link Following"},{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"}],"references":[{"url":"https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a","tags":["x_refsource_MISC"]}],"priority":{"score":8.6,"factors":[{"name":"EPSS percentile","points":3.53},{"name":"CVSS severity","points":5.11}]},"vendorSlug":"youki-dev","affectedVersions":[{"vendor":"youki-dev","product":"youki","versions":["< 0.5.7"]}],"affected":[{"ecosystem":"crates.io","package":"youki","vulnerableRanges":["<0.5.7"],"patched":["0.5.7"],"from":["GHSA-4g74-7cff-xcv8"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-37939","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","children":[{"from":"CVE-2025-62161","to":"CVE-2025-31133","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-4g74-7cff-xcv8","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2"}]}],"packageHistory":[{"cve":"CVE-2025-54867","published":"2025-08-14","fixed":"0.5.5","kev":false,"link":{"from":"CVE-2025-54867","to":"CVE-2025-62161","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"crates.io:youki","fromFixed":"0.5.5","toFixed":"0.5.7","daysApart":83},{"kind":"similar","provenance":"machine","score":0.47,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2025-62161","published":"2025-11-05","fixed":"0.5.7","kev":false},{"cve":"CVE-2025-62596","published":"2025-11-05","fixed":"0.5.7","kev":false}],"package":"crates.io:youki"}}