{"id":"GHSA-mc8h-8q98-g5hr","summary":"Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all","details":"The `remove_dir_all` crate is a Rust library that offers additional features over the Rust standard library `fs::remove_dir_all` function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.\n\nThanks to the Rust security team for identifying the problem and alerting us to it.","aliases":["RUSTSEC-2023-0018"],"modified":"2026-09-10T03:49:52.047436844Z","published":"2023-02-24T16:23:59Z","database_specific":{"cwe_ids":["CWE-366","CWE-367"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2023-02-24T16:23:59Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/XAMPPRocky/remove_dir_all/security/advisories/GHSA-mc8h-8q98-g5hr"},{"type":"WEB","url":"https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead"},{"type":"PACKAGE","url":"https://github.com/XAMPPRocky/remove_dir_all"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0018.html"}],"affected":[{"package":{"name":"remove_dir_all","ecosystem":"crates.io","purl":"pkg:cargo/remove_dir_all"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-mc8h-8q98-g5hr/GHSA-mc8h-8q98-g5hr.json"}}],"schema_version":"1.9.0"}