GitHub Advisoryadvisory · PyPI

GHSA-6w46-j5rx-g56g pytest has vulnerable tmpdir handling

MEDIUM Published 2026-01-22 Modified 2026-04-13 Official page ↗
Aliases
CVE-2025-71176
Ecosystem
PyPI
Packages
pytest
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-379
Reviewed
2026-04-13

Affected packages

• PyPI pytest: < 9.0.3 → fixed in 9.0.3

Description

pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Related

Alias · CVE (1)

  • CVE-2025-71176 pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial… vulnerability

Weakness · CWE (1)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References