CVE-2025-62161 - CVE House
Back to Database
Status published High CVE-2025-62161

youki container escape via "masked path" abuse due to mount race conditions

Vulnerability Description

Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62161

Credits & Attribution

No credits recorded in the NVD database.

References

More from youki-dev

View All →
CVE-2025-62596
youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects
High 7.3
CVE-2025-54867
Youki Symlink Following Vulnerability
High 7
CVE-2025-27612
Libcontainer is affected by capabilities elevation
Medium 5.9

Affected Vendor

Affected Software

youki
Vulnerable Versions:
< 0.5.7

Timeline

Official Publish: November 5th, 2025
Last Modified: November 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-363 CWE-61

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.