CVE-2026-54574
2 advisories.
PyPI/proot-distro CVE-2026-54574: high 8.2
`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
Action: Upgrade proot-distro to 5.1.5 or later.
pip install proot-distro==5.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.1.5 | - |
Fixed versions
| 5.1.5 |
Sources
- osv: GHSA-9xq3-3fqg-4vg7
- https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7
- https://github.com/termux/proot-distro/commit/a96d7a9667f38e45d812614852ee3915d1c0ae45
- https://github.com/termux/proot-distro
- https://github.com/termux/proot-distro/releases/tag/v5.1.5
CVE-2026-54574 · published · modified · JSON
PyPI/proot-distro CVE-2026-54574: high 8.2
`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
Action: Upgrade proot-distro to 5.1.5 or later.
pip install proot-distro==5.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.1.5 | - |
Fixed versions
| 5.1.5 |
Sources
- osv: PYSEC-2026-3608
- https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7
- https://github.com/termux/proot-distro/commit/a96d7a9667f38e45d812614852ee3915d1c0ae45
- https://github.com/termux/proot-distro
- https://github.com/termux/proot-distro/releases/tag/v5.1.5
- https://pypi.org/project/proot-distro
- https://github.com/advisories/GHSA-9xq3-3fqg-4vg7
- https://nvd.nist.gov/vuln/detail/CVE-2026-54574
CVE-2026-54574 · published · modified · JSON