trifectatechfoundation sudo-rs up to 0.2.5 information expsure

Summaryinfo

A vulnerability labeled as problematic has been found in trifectatechfoundation sudo-rs up to 0.2.5. This affects an unknown part. Executing a manipulation can lead to information expsure. This vulnerability is tracked as CVE-2025-46718. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in trifectatechfoundation sudo-rs up to 0.2.5. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a information expsure vulnerability. The CWE definition for the vulnerability is CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. As an impact it is known to affect confidentiality. CVE summarizes:

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the `-U` flag. This vulnerability allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions. Attackers can collect information that can be used to more targeted attacks. Systems where users either do not have sudo privileges or have the ability to run all commands as root through sudo (the default configuration on most systems) are not affected by this advisory. Version 0.2.6 fixes the vulnerability.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-46718 since 04/28/2025. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 0.2.6 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System Utility Software

Vendor

• trifectatechfoundation

Name

• sudo-rs

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4
• 0.2.5

Website

• Product: https://github.com/trifectatechfoundation/sudo-rs/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion