Executive brief
GNU sed is a widely used command-line tool for processing and editing text files on Linux and Unix-like systems. A vulnerability exists when the tool is used to edit files in-place while following symbolic links, which could allow a local attacker to trick the program into overwriting unintended files. If a system administrator or a privileged process runs a vulnerable version of sed on files in a directory accessible to an attacker, it could lead to unauthorized data modification or system instability.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in GNU sed's open_next_file() function. When invoked with both '-i' (in-place) and '--follow-symlinks', the program first resolves a symlink to its target path using readlink() but then subsequently opens the original symlink path rather than the resolved path to read the file. An attacker can exploit this non-atomic window by replacing the symlink with a different target between the resolution and the open operation. This causes sed to read content from an attacker-chosen file and write the processed output to the originally resolved target, potentially allowing a local attacker to overwrite sensitive files in the context of the user running sed. The issue is fixed in version 4.10 by ensuring the already-resolved path is used for the open operation.
Affected products
- GNU sed 4.1e to 4.9
Timeline
- 2026-04-10: other: Vulnerability reported to linux-distros mailing list
- 2026-04-20: advisory: Initial advisory published by CERT Polska
- 2026-04-21: patched: GNU sed version 4.10 released with fix
- 2026-05-13: other: Public disclosure on oss-security mailing list