GitHub Advisoryadvisory · crates.io

GHSA-qwcc-2r77-5w2f sd changes the group ownership of the source file

MEDIUM Published 2025-12-10 Modified 2025-12-10 Official page ↗

Aliases: CVE-2025-65807
Ecosystem: crates.io
Packages: sd
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses: CWE-266
Reviewed: 2025-12-10

Affected packages

• crates.io sd: <= 1.0.0 (no fix yet)

Description

An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.

Related

Alias · CVE (1)

CVE-2025-65807 An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. vulnerability

Weakness · CWE (1)

CWE-266 Incorrect Privilege Assignment weakness

References