Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Pleaseedit in Linux 0.4 allows local attackers to gain root access

CVE-2021-31154 · published 5 years ago
Summary

A flaw in the Pleaseedit in Linux version 0.4 makes it possible for local attackers to gain full control of the system. This is because the software uses predictable temporary filenames, which can be exploited to create a symlink attack. To fix this, update to a version of Pleaseedit that no longer uses predictable filenames.

What to do
  • Update edneville pleaser to version 0.4.0.
  • Update pleaseedit_project pleaseedit to version 0.4 or later.
Affected software
Ecosystem VendorProductAffected versions
rust edneville pleaser < 0.4.0
Fix: upgrade to 0.4.0
– pleaseedit_project pleaseedit < 0.4
cpe:2.3:a:pleaseedit_project:pleaseedit:*:*:*:*:*:*:*:*
Original advisory text
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-59Link Following
CWE-340Generation of Predictable Numbers or Identifiers
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published27 May 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-pp74-39w2-v4w9 · GHSA
CVE-2021-31154 · NVD
Track software like this
Free during beta