CVE-2026-49134: CodexBar Privilege Escalation in CLI Installer (Race Condition)

Technical summary

The vulnerability exists in CodexBar's installer logic, which uses mktemp to create temporary files and subsequently writes a privileged shell payload into them before executing via bash with elevated privileges. An attacker capable of monitoring or writing to the temporary filesystem can exploit a race condition between file creation and payload execution. By rewriting the installer body before the administrator approval prompt is processed, the attacker forces the bash execution context to run attacker-controlled commands as root. This is a classic TOCTOU (time-of-check-time-of-use) issue in file handling during privileged operations.

Business impact

Successful exploitation results in complete compromise of affected systems. An attacker gaining root access can install backdoors, exfiltrate sensitive data, modify or delete critical files, or establish persistence. Organizations running CodexBar installers in shared or multi-tenant environments face heightened risk. The impact extends beyond the CodexBar application itself—root access enables lateral movement and compromise of dependent services and data.

Affected systems

CodexBar prior to version 0.32.0 is affected. The vulnerability is triggered during the CLI installer execution, so exposure is limited to systems on which the installer is actively running or has been recently executed. Systems with CodexBar already installed and not running the installer are not directly vulnerable to this specific flaw, though best practice is to upgrade to 0.32.0 or later.

Exploitability

Exploitation requires local system access and the ability to observe or modify temporary files, placing it in the 'local' attack vector category. An attacker must also have timing precision to interfere with the installer before the administrator approval prompt is satisfied. While the bar to exploitation is non-trivial, it is achievable by a determined attacker on shared systems, containers, or systems with weak file permission controls on /tmp or equivalent temporary directories. The race condition window may be narrow but reliable.

Remediation

Upgrade CodexBar to version 0.32.0 or later. If immediate upgrade is not feasible, restrict access to temporary file directories (/tmp, /var/tmp) via file system permissions or mounting with noexec flags. Limit installer execution to isolated environments or single-user machines where feasible. Avoid running the installer on shared multi-user systems or in untrusted container environments until patched.

Patch guidance

Verify that CodexBar is updated to 0.32.0 or later by checking the installed version (typically available via 'codexbar --version' or equivalent). Consult the official CodexBar release notes to confirm patch availability and any deployment considerations. Test the patched version in a non-production environment before broad rollout. If CodexBar is deployed via package management systems, ensure the repository index is refreshed and the latest version is installed.

Detection guidance

Monitor execution of mktemp and subsequent bash invocations in the /tmp directory during CodexBar installer execution. Audit file modification events on temporary files immediately after their creation. Look for suspicious process spawning from temporary directories, particularly any commands executed as root originating from /tmp or /var/tmp. Enable enhanced logging on installer execution (if available) and correlate with system call tracing tools like auditd or strace. Detect multiple rapid file operations in temporary directories during installer runs as a potential race condition exploitation attempt.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.1) due to the combination of high confidentiality, integrity, and availability impact from root-level code execution, balanced against the requirement for local access and user interaction (administrator approval). Organizations should prioritize this for systems where CodexBar installers are regularly executed or where shared system access is common. However, it is not a network-exploitable flaw and does not appear in active exploitation databases (KEV), allowing time for orderly patching.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: network attack vector of 'Adjacent' (local), attack complexity 'High' due to race condition timing and file system conditions, privilege escalation from local user to root (high impact), and lack of user interaction beyond approval of the installation itself. The score appropriately captures a serious local flaw that is not trivially exploitable but is critical when successful. Organizations with strict change control over installation processes may score this lower in their own risk model.

Frequently asked questions