{"id":"EUVD-2025-37939","enisaUuid":"6aa93eaa-1558-349b-8840-838718233c74","description":"Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container\u0027s /dev/null as a file mask. This issue is fixed in version 0.5.7.","datePublished":"Nov 5, 2025, 11:09:09 PM","dateUpdated":"Nov 6, 2025, 9:20:19 PM","baseScore":7.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8\nhttps://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8\nhttps://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a\n","aliases":"CVE-2025-62161\nGHSA-4g74-7cff-xcv8\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"755592ab-ec9a-3bcf-bb91-ad3d7f6c9648","product":{"name":"youki","vendor":{"name":"youki-dev"}},"product_version":"\u003c 0.5.7"}],"enisaIdVendor":[{"id":"c038eb50-8677-3128-bcab-99862967e1dd","vendor":{"name":"youki-dev"}}],"enisaIdVulnerability":[{"id":"6979da03-77be-339a-93e6-7361ceccfee8","vulnerability":{"id":"GHSA-4g74-7cff-xcv8","description":"youki container escape via \"masked path\" abuse due to mount race conditions","datePublished":"Nov 5, 2025, 6:44:18 PM","dateUpdated":"Nov 15, 2025, 2:25:02 AM","baseScore":0.0,"references":"https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2\nhttps://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-62161\nhttps://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a\nhttps://github.com/youki-dev/youki\n","enisa_id":"EUVD-2025-37939\n","aliases":"GHSA-4g74-7cff-xcv8\nCVE-2025-62161\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b53d44b3-5c92-3aff-88e8-c25ac552c4d3","vulnerability":{"id":"CVE-2025-62161","description":"Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container\u0027s /dev/null as a file mask. This issue is fixed in version 0.5.7.","datePublished":"Nov 5, 2025, 11:09:09 PM","dateUpdated":"Nov 6, 2025, 9:20:19 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8\nhttps://github.com/youki-dev/youki/security/advisories/GHSA-4g74-7cff-xcv8\nhttps://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a\n","enisa_id":"EUVD-2025-37939\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 6, 2026, 7:20:53 AM","vulnerabilityProduct":[{"id":"4aac3201-d870-3d05-b0b9-c5c797821867","product":{"name":"youki","vendor":{"name":"youki-dev"}},"product_version":"\u003c 0.5.7"}],"vulnerabilityVendor":[{"id":"b8ab2874-fbb7-3d79-bfcd-593587c81c75","vendor":{"name":"youki-dev"}}]}}],"enisaIdAdvisory":[]}