CVE-2025-62161 — youki container escape via "masked path" abuse due to mount race conditions
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki u…
Published: 2025-11-05 · CVSS: 7.3 · CVSS 4.0
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7