CVE-2026-49134
CVE-2026-49134 is a high-severity vulnerability with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-377.
Key facts
- Severity: High (CVSS 3.x base score 7.1)
- CVSS v4: 7.5
- EPSS exploit prediction: 0% (19th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-33750
- Weakness: CWE-377
- Published:
- Last modified:
Description
CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.
Frequently asked questions
- What is CVE-2026-49134?
- CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.
- How severe is CVE-2026-49134?
- CVE-2026-49134 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2026-49134 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-49134?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-49134 have an EU (EUVD) identifier?
- Yes. CVE-2026-49134 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-33750.
- When was CVE-2026-49134 published?
- CVE-2026-49134 was published on 2026-06-01 and last updated on 2026-06-17.
References
- https://github.com/steipete/CodexBar/commit/dbc944d46cd4cf7877d1ca47c44556fe573b46e8
- https://github.com/steipete/CodexBar/pull/1222
- https://github.com/steipete/CodexBar/releases/tag/v0.32.0
- https://www.vulncheck.com/advisories/codexbar-privilege-escalation-via-cli-installer-temp-file
Other CWE-377 (Insecure Temporary File) vulnerabilities
- CVE-2011-4119 — Critical (CVSS 9.8): caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
- CVE-2012-2666 — Critical (CVSS 9.8): golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a…
- CVE-2015-5224 — Critical (CVSS 9.8): The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name…
- CVE-2025-14307 — High (CVSS 8.1): An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The…
- CVE-2023-43498 — High (CVSS 8.1): In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates…
- CVE-2025-46369 — High (CVSS 7.8): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File…
Browse all CWE-377 (Insecure Temporary File) vulnerabilities →