GHSA-6w46-j5rx-g56g

pytest has vulnerable tmpdir handling

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-71176

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pytest	< 9.0.3	9.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-71176 advisory
https://github.com/pytest-dev/pytest/issues/13669 web
https://github.com/pytest-dev/pytest/pull/14343 web
https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c web
https://github.com/pytest-dev/pytes package
https://github.com/pytest-dev/pytest/releases/tag/9.0.3 web
https://www.openwall.com/lists/oss-security/2026/01/21/5 web