Listen to this Post
CVE-2025-71176 is a security vulnerability in the pytest testing framework affecting versions up to 9.0.2 on UNIX platforms.
The flaw exists within the `tmpdir` handling mechanism used during test execution.
Pytest traditionally relies on a predictable naming pattern for its root temporary directories located in the system temporary folder.
Specifically, it creates directories matching the format `/tmp/pytest-of-{user}` based on the current username.
In shared multi-user UNIX environments, this predictable path format exposes users to local attack vectors.
An attacker with local access on the same machine can anticipate the exact directory path that a victim user will generate.
By pre-creating a directory or establishing a symlink at that predictable path before the victim runs pytest, the attacker sets up a race condition.
When the victim executes tests, pytest attempts to initialize its temporary workspace inside this predictable path location.
Although the framework includes heuristics and ownership checks via `stat()` system calls to validate the directory, these checks are prone to edge cases.
In environments where kernel-level protections like protected symlinks or hardlinks are disabled or unsupported, these checks fail to prevent abuse.
An attacker can exploit this behavior to cause a denial of service by disrupting test runs or blocking file creation.
In more complex scenarios, it may allow local users to manipulate file integrity or induce unintended file writes in victim-owned contexts.
The root cause stems from using static, predictable base directory names instead of secure random temporary generation functions.
Python’s standard library provides secure alternatives such as `tempfile.mkdtemp()` which generate unpredictable paths with strict permissions.
The upstream maintainers resolved this vulnerability in pytest version 9.0.3 by improving temporary directory creation and verification logic.
Security researchers and automated tools track this flaw under GitHub Advisory identifier GHSA-6w46-j5rx-g56g.
Immediate upgrading to patched releases is essential for securing development pipelines and continuous integration environments against local tampering.
DailyCVE Form:
Platform: Pytest framework
Version: Through 9.0.2
Vulnerability : Unsafe tmpdir handling
Severity: Medium severity
date: January 2026
Prediction: Patched in 9.0.3
What Undercode Say:
Analytics & Code Context
Check current installed pytest version pytest --version Upgrade pytest to patched version 9.0.3 or higher pip install --upgrade "pytest>=9.0.3,<10.0" Set secure temporary root environment variable as a workaround if needed export PYTEST_DEBUG_TEMPROOT=$(mktemp -d)
Exploit: (Educational Purposes!)
In an environment where kernel protections (fs.protected_symlinks) are disabled, a local attacker can create a symbolic link targeting the predictable `/tmp/pytest-of-
Protection: from this CVE
Upgrade pytest immediately to version 9.0.3 or higher where the insecure temporary directory handling mechanism is resolved. Additionally, ensure that modern Linux kernel security sysctls (fs.protected_symlinks and fs.protected_hardlinks) are enabled on multi-user systems. Developers can also define the `PYTEST_DEBUG_TEMPROOT` environment variable pointing to a securely created private directory via mktemp -d.
Impact:
Local attackers sharing the same multi-user host can launch denial of service attacks against test executions or potentially compromise file integrity within temporary directories. Since pytest is typically executed in isolated CI pipelines or single-user developer machines, the real-world exploitability in standard setups is moderate, but shared server environments face heightened local risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
