VulnerabilityDeferred

CVE-2026-77059

boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.

HIGH 8.8EPSS —

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unscored. Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root. This issue was fixed in version 1.6.0.

CVSS 4.0: 8.8 HIGHCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: No score yet
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-367
Source: cvd@cert.pl

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.