CVE-2026-57825: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-57825 is a sandbox escape vulnerability in opam (the OCaml package manager) that allows a malicious package to write files outside the designated opam switch prefix by exploiting symlinks in .install files. It was reported on 2026-05-15, fixed on 2026-07-07 (merged to master), and opam 2.5.2 was released with the fix on 2026-07-08. The vulnerability affects opam-devel versions prior to 2.5.2 and has a CVSS v3.0 score of 5.7 (Medium) (OSEC-2026-10, GitHub PR #7005).

The root cause is classified as CWE-693 (Protection Mechanism Failure): when opam processes .install files during package installation, it checks that target paths remain within the switch prefix, but fails to resolve symlinks before performing this check. A malicious package can first create a symlink inside the switch's share directory pointing to an arbitrary location (e.g., $HOME), then use the .install file to install a file through that symlink, effectively writing to a path outside the sandbox. The fix, authored by Nathan Rebours and reviewed by Raja Boujbel, ensures symlink resolution is performed before the prefix boundary check (OSEC-2026-10, GitHub PR #7005).

Successful exploitation allows a malicious opam package to write arbitrary files to locations outside the opam switch sandbox, including the user's home directory or other user-writable paths. This can lead to integrity violations such as overwriting shell configuration files (e.g., .bashrc, .profile), SSH authorized keys, or other sensitive user-owned files, potentially enabling privilege escalation or persistent access. Confidentiality and availability are not directly impacted according to the CVSS vector, but the integrity impact is rated High (OSEC-2026-10).

A proof-of-concept exploit scenario is publicly documented in the official security advisory: a crafted package uses an install step to create a symlink inside the switch's share directory pointing to $HOME, then the .install file directs opam to place a file through that symlink, landing it in the user's home directory. Exploitation requires the victim to install a malicious package (network-accessible, low privilege, user interaction required per the CVSS vector). No evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV listing has been reported. No EPSS score is currently available for this CVE (OSEC-2026-10).

1. Craft a malicious package: Create an opam package with a .install file (e.g., test.install) containing a share_root entry that maps a file to a path traversing through a symlink, such as share_root: [ "test" {"blah/pwnd"} ].
2. Add a symlink-creating install step: In the package's test.opam file, include an install command that creates a symlink inside the switch's share directory pointing to the target location outside the sandbox, e.g., install: ["sh" "-c" "ln -s \"$HOME\" \"%{share}%/blah\""].
3. Distribute the package: Publish the malicious package to a repository accessible to the victim, or social-engineer the victim into installing it directly.
4. Victim installs the package: When the victim runs opam install <malicious-package>, opam executes the install step (creating the symlink) and then processes the .install file without resolving the symlink, writing the file to $HOME/pwnd instead of within the switch prefix.
5. Achieve arbitrary file write: The attacker's chosen file is now written to the victim's home directory (or another user-writable path), enabling follow-on attacks such as overwriting .bashrc or .ssh/authorized_keys for persistence (OSEC-2026-10).

• File System: Unexpected symlinks inside the opam switch share directory (e.g., ~/.opam/<switch>/share/<name>) pointing to locations outside the switch prefix such as $HOME or system directories.
• File System: Unexpected or newly created files in the user's home directory or other non-opam paths (e.g., ~/pwnd) coinciding with an opam package installation event.
• Logs: opam installation logs showing .install file processing for packages from untrusted or unfamiliar sources around the time of suspicious file creation.
• Process: Shell processes (e.g., sh, bash) spawned during opam install that execute ln -s commands creating symlinks pointing outside the switch directory.

Users should upgrade opam to version 2.5.2 or later, which includes the fix (commit 09c3df1 on master, backported to the 2.5 branch via PR #7006). Debian, Ubuntu, openSUSE, and Fedora have issued updated packages for their respective distributions. No configuration-based workaround is available; upgrading is the only reliable remediation. Users should also audit recently installed opam packages from untrusted sources for suspicious symlinks in their switch share directories (OSEC-2026-10, GitHub PR #7005).

The vulnerability was discovered and reported by Kate Deplaix (kit-ty-kate), with the fix developed by Nathan Rebours and reviewed by Raja Boujbel, coordinated through the OCaml Security team by Hannes Mehnert. The fix was merged promptly within approximately two weeks of the fix being written, and opam 2.5.2 was released the day after the patch landed. Linux distribution security teams (Debian, Ubuntu, openSUSE, Fedora) responded quickly with updated packages. Community coverage appeared in package management newsletters and Linux security news outlets (OSEC-2026-10, GitHub PR #7005).