CVE-2022-39245

HIGH

makedeb/mist < 0.9.5 - Authentication Bypass via PATH Variable Sudo Binary

Title source: llm
STIX 2.1

Description

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known workarounds exist.

References (3)

Core 3

Scores

CVSS v3 8.4
EPSS 0.0022
EPSS Percentile 11.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-305 CWE-287 CWE-426
Status published
Products (1)
makedeb/mist < 0.9.5
Published Sep 26, 2022
Tracked Since Feb 18, 2026