Executive brief
Tookie is an open-source intelligence (OSINT) tool used for gathering information about usernames across various platforms. A security flaw allows the tool to write files to unintended locations on a user's computer if it is provided with a specially crafted username containing directory traversal characters (like ../). This could allow an attacker to overwrite existing files or place data in sensitive folders if they can convince a user to scan a malicious list of usernames.
Technical details
A path traversal vulnerability exists in the modules/modules.py component of tookie-osint. The functions write_txt, write_csv, write_json, and scan_file use unsanitized input from the -u (single username) or -U (userfile) CLI arguments to construct output filenames using f-strings. By including path separators (../, /, or absolute paths) in the username, an attacker can force the application to write scan results to any directory where the current user has write permissions. While the impact is mitigated by forced file extensions (.txt, .csv, .json), it still allows for arbitrary file overwrite and data pollution. This issue is fixed in version 4.1fix.
Affected products
- Alfredredbird tookie-osint <= 4.1
Timeline
- 2026-04-23: other: Vulnerability verified by researcher
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD