Tookie Osint
Monthly
Path traversal in tookie-osint (all versions prior to 4.1fix) allows an attacker who controls the tool's username input to redirect scan output files to arbitrary filesystem paths accessible to the invoking user. The write_txt, write_csv, and write_json helpers in modules/modules.py construct output filenames via unsanitized f-string interpolation of the -u CLI flag or lines from a -U batch usernames file, enabling directory-separator sequences to escape the intended output directory. A proof-of-concept exists per SSVC assessment; however, EPSS sits at 0.01% (3rd percentile) and the vulnerability is absent from the CISA KEV catalog, consistent with the niche footprint of this tool and the local execution prerequisite.
Path traversal in tookie-osint (all versions prior to 4.1fix) allows an attacker who controls the tool's username input to redirect scan output files to arbitrary filesystem paths accessible to the invoking user. The write_txt, write_csv, and write_json helpers in modules/modules.py construct output filenames via unsanitized f-string interpolation of the -u CLI flag or lines from a -U batch usernames file, enabling directory-separator sequences to escape the intended output directory. A proof-of-concept exists per SSVC assessment; however, EPSS sits at 0.01% (3rd percentile) and the vulnerability is absent from the CISA KEV catalog, consistent with the niche footprint of this tool and the local execution prerequisite.