Executive Summary

CVE-2025-61659 is a security flaw in the bash-git-prompt project where temporary files are created with predictable names based on the process ID (pid), such as /tmp/git-index-private$$. Because these filenames are guessable, attackers can create symbolic links with those names to trick the script into overwriting arbitrary files via the cp command. This vulnerability arises from insecure temporary file handling and can be mitigated by using secure methods like mktemp to generate unpredictable temporary filenames and directories. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform symlink attacks that cause the bash-git-prompt script to overwrite arbitrary files on the system. This could lead to unauthorized modification or corruption of files, potentially compromising system integrity, causing data loss, or enabling further exploitation depending on which files are overwritten. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking for the presence of the predictable temporary files `/tmp/git-index-private$$` and `/tmp/git-index-private*.lock` where `$$` is the bash process ID. Since the process ID is guessable, you can list these files using commands like `ls /tmp/git-index-private*`. Additionally, you can find bash process IDs with `ps` commands (e.g., `ps -ef | grep bash`) and check if corresponding temporary files exist. Monitoring for unexpected symbolic links at these paths can also indicate exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves modifying the bash-git-prompt script to replace the use of predictable pid-based temporary filenames with secure, unpredictable filenames generated by `mktemp`. Specifically, use `mktemp` to create temporary files and directories (e.g., `mktemp -d`) to contain all temporary files including `.lock` files. This prevents attackers from predicting or creating symbolic links to these files, mitigating symlink attacks and arbitrary file overwrites. [1]

Useful 0 Not Useful 0