CVE-2026-112934: Python Toctou In Place Record Rewrite Opened By Name
$OPEN opens $PATH in write mode ($FLAGS) resolved purely by name and then the descriptor is written, but the open is not anchored to a vetted directory fd (no dir_fd=), is not non-blocking (no O_NONBLOCK, so a planted named pipe stalls the open forever), and the enclosing function never re-checks the descriptor's kernel identity with os.fstat (S_ISREG / st_d
Pythongreprules fetch cve-2026-112934-python-toctou-in-place-record-rewrite-opened-by-name --engine opengrepDescription
$OPEN opens $PATH in write mode ($FLAGS) resolved purely by name and then the descriptor is written, but the open is not anchored to a vetted directory fd (no dir_fd=), is not non-blocking (no O_NONBLOCK, so a planted named pipe stalls the open forever), and the enclosing function never re-checks the descriptor's kernel identity with os.fstat (S_ISREG / st_d
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.