EUVD-2026-29183Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local CLI execution required with user-supplied input; only filesystem integrity is impacted; no confidentiality or availability effect applies.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_txt, write_csv, write_json, and (commented-but-shipping) scan_file helpers open their output as open(f"{user}.<ext>"), where user comes unsanitized from the -u CLI flag or any line of a -U usernames file. A username that contains path-separator sequences (.., /, \, or an absolute path) causes tookie-osint to write the scan output to an arbitrary path the invoking user has write permission for. This vulnerability is fixed in 4.1fix.
AnalysisAI
Path traversal in tookie-osint (all versions prior to 4.1fix) allows an attacker who controls the tool's username input to redirect scan output files to arbitrary filesystem paths accessible to the invoking user. The write_txt, write_csv, and write_json helpers in modules/modules.py construct output filenames via unsanitized f-string interpolation of the -u CLI flag or lines from a -U batch usernames file, enabling directory-separator sequences to escape the intended output directory. A proof-of-concept exists per SSVC assessment; however, EPSS sits at 0.01% (3rd percentile) and the vulnerability is absent from the CISA KEV catalog, consistent with the niche footprint of this tool and the local execution prerequisite.
Technical ContextAI
tookie-osint is a Python-based OSINT information-gathering CLI tool (CPE: cpe:2.3:a:alfredredbird:tookie-osint:*:*:*:*:*:*:*:*) authored by Alfredredbird. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the output helpers in modules/modules.py call Python's built-in open() using direct f-string interpolation, e.g. open(f"{user}.<ext>"), where user is derived verbatim from the -u flag or any line of a -U usernames file. Python's open() resolves the resulting path against the process working directory without any canonicalization, so sequences such as ../, ..\ , or an absolute path prefix silently redirect the file write. Notably, the scan_file helper is flagged as commented-but-shipping, meaning the vulnerable pattern exists even in partially inactive code paths, broadening the affected surface within the module.
RemediationAI
Upgrade tookie-osint to version 4.1fix, which addresses the unsanitized path construction in modules/modules.py. Full patch details are available in the vendor advisory at https://github.com/Alfredredbird/tookie-osint/security/advisories/GHSA-rp68-wfv6-3cq3. If immediate upgrade is not feasible, apply the following specific compensating controls: first, sanitize all usernames before passing them to tookie-osint by stripping or rejecting strings containing /, \, and .. sequences via a preprocessing script or shell wrapper - this prevents traversal sequences from reaching the vulnerable helpers. Second, run tookie-osint inside a dedicated, isolated working directory with restricted write permissions (e.g., a tmpfs mount or a directory with no sensitive content) so that any traversal-induced write is confined to a controlled blast radius. Third, avoid processing untrusted or externally-sourced username lists without prior validation. Note that directory restriction does not fully mitigate the flaw if the attacker supplies an absolute path in the username.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today