CVE-2025-62161
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.24%
- CWE
- CWE-363, CWE-61
- Published
- 2025-11-05
- Last modified
- 2026-03-13
Affected products
- youki-dev youki
Weakness type
Related vulnerabilities
- CVE-2025-13492 — HP Image Assistant - Potential Escalation of Privilege
- CVE-2025-52881 — runc: LSM labels can be bypassed with malicious config using dummy procfs files
- CVE-2025-52565 — container escape due to /dev/console mount and related races
- CVE-2025-31133 — runc container escape via "masked path" abuse due to mount race conditions
- CVE-2025-62596 — youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects
- CVE-2024-45310 — runc can be confused to create empty files/directories on the host
- CVE-2024-27102 — Improper isolation of server file access in github.com/pterodactyl/wings
- CVE-2022-21658 — Race condition in std::fs::remove_dir_all in rustlang