-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| numpy | pip | < 1.8.1 | 1.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the use of tempfile.mktemp() in numpy/f2py/init.py's compile function. mktemp() returns a filename without creating the file, creating a race condition where an attacker could pre-create a symlink at that path. The GitHub commit 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 explicitly replaces mktemp() with NamedTemporaryFile in this file, confirming this as the primary vulnerable code path. Other instances of mktemp() in the diff (e.g., in test files) were also fixed but are less critical as they relate to test code rather than the core f2py functionality exploited in CVE-2014-1858.