Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Calling `validate_before_stdio_spawn` directly instead of preparing and binding the launch via `prepare_stdio_launch` creates a TOCTOU race condition where spawned executables or arguments may be manipulated between validation and execution.
Performing separate metadata lookups during recursive directory iteration may introduce TOCTOU race conditions.
Using 'kSecGuestAttributePid' to query code signatures via SecCodeCopyGuestWithAttributes is vulnerable to PID reuse and exec race conditions. Use 'kSecGuestAttributeAudit' with an audit_token_t instead.
File operation relies on incomplete daemon/chroot state checks rather than checking active relative path confinement or using race-free directory file descriptor operations. This can expose path resolution to TOCTOU symlink races.
A networked data chunk is fetched in a loop and hashed directly without prior validation or confirmation. This can lead to a Time-of-Check to Time-of-Use (TOCTOU) vulnerability where the user confirms an initial data subset but a malicious host provides different subsequent chunks during the hashing phase.
Applying `setxattr` on string paths inside a loop (often part of directory traversal or deferred attribute application) introduces a Time-of-Check to Time-of-Use (TOCTOU) race condition. If an attacker replaces a traversed directory with a symlink before the attribute application, `setxattr` will follow the symlink, allowing modifications on unintended arbit
A Time-of-Check to Time-of-Use (TOCTOU) race condition was detected. A file was verified or checked (e.g., checking trust status, signature, or auth), and then subsequently re-read from the filesystem. An attacker could overwrite or swap the file between the check and the read, modifying the supposedly verified content. To fix this, read the file into memory
Insecure filesystem scoping or unsafe manual symlink checks detected. Using `afero.NewBasePathFs` directly on struct fields or implementing exported manual TOCTOU checks with `filepath.EvalSymlinks` allows attackers to bypass directory restrictions and escape scopes. Encapsulate filesystem access in safe abstractions and avoid exported manual TOCTOU checks.
Incomplete daemon/chroot check allows TOCTOU symlink race conditions during file operations. Ensure secure path resolution is active for all non-chrooted receiver transfers.
Delegating path containment to openat2 with RESOLVE_BENEATH is susceptible to TOCTOU symlink race conditions. Use a step-by-step held dirfd-stack resolver with O_NOFOLLOW to safely traverse directory paths.
Detects on-the-fly file reading to compute an HMAC for integrity verification without atomically using the read data. This pattern indicates a Time-of-Check Time-of-Use (TOCTOU) vulnerability if the application relies on an in-memory representation populated earlier. The integrity check validates the disk state, but the execution uses potentially malicious i
A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists. A path is checked for its type (e.g., using `is_dir()`) and subsequently deleted using a vulnerable unanchored operation such as `shutil.rmtree()` or `unlink()`. An attacker can substitute the path with a symlink between the check and the deletion, leading to arbitrary file deletion outside intended
Checking whether a path is a directory and conditionally deleting it using unanchored deletion methods (`shutil.rmtree`, `.unlink()`, `os.remove`) creates a Time-of-Check Time-of-Use (TOCTOU) race condition. If an attacker swaps a parent directory with a symlink between the check and the deletion call, arbitrary files and directories outside the intended bou
Time-of-Check to Time-of-Use (TOCTOU) vulnerability. The file $PATH is validated but then re-read from disk. An attacker could modify the file between the check and the read, bypassing the validation. Return the verified content directly from the validation function instead of re-reading.
Time-of-Check-Time-of-Use (TOCTOU) race condition detected during first user registration. Checking the active user count before insertion can allow multiple concurrent requests to evaluate as the "first user" and be granted administrative rights. Insert the newly registered user with a default standard role first, then evaluate the user count strictly post-
A URL validation check is performed before an HTTP request, but the original URL string is passed to the network client. If the validation performs an IP address check via DNS resolution, this pattern is susceptible to Time-of-Check to Time-of-Use (TOCTOU) DNS Rebinding attacks. To fix this, resolve the IP securely and pass the IP directly to the HTTP client
Using Cranelift built-in libcalls for Wasm passive data segments (`array.new_data`, `memory.init`, `data.drop`) is unsafe under asynchronous (fiber-based) execution. It creates a Time-of-Check to Time-of-Use (TOCTOU) vulnerability where bounds checks are performed before an implicit fiber yield, exposing segments to concurrent mutation or deletion. Inline bo
A path is resolved to perform directory sandbox validation, but the function subsequently returns the original, unresolved path. This produces a Time-of-Check to Time-of-Use (TOCTOU) race condition. A local attacker can tamper with path symlinks after the path has been validated but before it is used, escaping the restricted directory. Return the safely reso
The application checks an input conditionally but then performs an HTTP request using an independent HTTP client (httpx). This creates a Time-of-Check to Time-of-Use (TOCTOU) vulnerability known as DNS Rebinding. If the check resolves DNS, the IP might change before the HTTP client connects. Secure the HTTP client inherently by enforcing IP checks directly a
Time-of-Check to Time-of-Use (TOCTOU) data race detected. A structure field is checked for NULL and then dereferenced. In multithreaded environments, another thread can nullify or free the pointer between the check and the dereference, causing a NULL pointer dereference. Either cache the pointer in a local variable or wrap the check and use securely within a
Returning UpdateLDCacheHook without pairing it with CreateSonameSymlinksHook leaves the container susceptible to TOCTOU symlink attacks within ldconfig.
Opening a file using `os.O_CREAT` without `os.O_NOFOLLOW` can be vulnerable to TOCTOU symlink attacks. If an attacker can replace the file with a symlink before creation, the operation may target an unexpected file. Include `os.O_NOFOLLOW` in the flags, and consider using `getattr(os, "O_NOFOLLOW", 0)` for cross-platform compatibility.
Userspace pointer field dereference ($PTR->$FIELD) in syscall verifier memory validation without copying the containing struct to kernel memory first. This creates a TOCTOU race condition where a concurrent userspace thread can swap the nested pointer after validation.
Time-of-Check to Time-of-Use (TOCTOU) vulnerability detected. Calling `stat()` and then `chmod()` on the same path without `follow_symlinks=False` allows an attacker to swap a file or directory with a symbolic link between the two calls. This can lead to arbitrary file permission alteration or privilege escalation. Ensure you pass `follow_symlinks=False` to
