medium6.8
CVE-2025-71176
pytest has vulnerable tmpdir handling
Impact
pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pytest | < 9.0.3 | 9.0.3 |
Affected products
| Product | Affected versions |
|---|---|
| Pytest | through 9.0.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/pytest-dev/pytest/issues/13669
- https://www.openwall.com/lists/oss-security/2026/01/21/5
- https://github.com/advisories/GHSA-6w46-j5rx-g56g
- https://nvd.nist.gov/vuln/detail/CVE-2025-71176
- https://github.com/pytest-dev/pytest/pull/14343
- https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c
- https://github.com/pytest-dev/pytest/releases/tag/9.0.3