CVE-2023-2800: Python Insecure Tempfile Mktemp
Use of `tempfile.mktemp()` followed by `open()` on the returned path is insecure (CWE-377 / CVE-2023-2800). `mktemp()` only predicts a filename without atomically creating the file, opening a TOCTOU race in which a local attacker can place a symlink at the predicted path before it is opened, leading to arbitrary file overwrite. Replace this pattern with `tem
Pythongreprules fetch cve-2023-2800-python-insecure-tempfile-mktemp --engine opengrepDescription
Use of `tempfile.mktemp()` followed by `open()` on the returned path is insecure (CWE-377 / CVE-2023-2800). `mktemp()` only predicts a filename without atomically creating the file, opening a TOCTOU race in which a local attacker can place a symlink at the predicted path before it is opened, leading to arbitrary file overwrite. Replace this pattern with `tem
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.