CVE-2025-65807 — Vulnerability in sd — CVE Details
MEDIUM
sd changes the group ownership of the source file
Published December 10, 2025Updated December 10, 2025Source: osv
Summary
An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.
Advisory Timeline
- First published December 10, 2025 (306 days ago).
- Last revised December 10, 2025 — 0 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: crates.io (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| sd | crates.io | All versions | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-266
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Frequently Asked Questions
- What is CVE-2025-65807?
- sd changes the group ownership of the source file This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
- How do I check if my project is affected by CVE-2025-65807?
- CVE-2025-65807 affects sd. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-65807 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
6.5
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-qwcc-2r77-5w2f
Related CVEs
- CVE-2026-102821MEDIUM
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
- CVE-2026-102820MEDIUM
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies