Proot Distro
Monthly
Arbitrary host file write in termux/proot-distro before 5.1.5 lets a malicious rootfs tarball or Docker layer plant an absolute-path symlink during `proot-distro install`, so a follow-up file member is written through that symlink onto the host filesystem - outside the container, before it is ever run. The install/reset paths (_extract_plain_tar) and the Docker layer path (_apply_layer) validated member names for '..' traversal but never validated symlink targets in member.linkname. No public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and fully described by the vendor GHSA advisory with vulnerable source shown.
Arbitrary host file write in termux/proot-distro before 5.1.5 lets a malicious rootfs tarball or Docker layer plant an absolute-path symlink during `proot-distro install`, so a follow-up file member is written through that symlink onto the host filesystem - outside the container, before it is ever run. The install/reset paths (_extract_plain_tar) and the Docker layer path (_apply_layer) validated member names for '..' traversal but never validated symlink targets in member.linkname. No public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and fully described by the vendor GHSA advisory with vulnerable source shown.