Vulnerability GHSA-mc8h-8q98-g5hr
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
3 years ago
February 24, 2023 at 04:23 PM UTC
Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
0.1.0 - 0.7.0
0.1.0 - 0.7.0
Summary
Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
Details
The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.
Thanks to the Rust security team for identifying the problem and alerting us to it.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
3 years ago
February 24, 2023 at 04:23 PM UTC
Last Modified
2 months ago
September 10, 2026 at 03:49 AM UTC