CVE-2026-5958: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-5958 is a Time-of-check Time-of-use (TOCTOU) race condition in GNU sed affecting versions 4.1e through 4.9 when invoked with both -i (in-place edit) and --follow-symlinks options. The vulnerability was discovered by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, reported to CERT Polska, and publicly disclosed on April 20, 2026, with a fix released in sed 4.10 on April 21, 2026. It carries a CVSS v4.0 base score of 2.1 (Low), assigned by CERT.PL (GitHub Advisory, oss-security).

The root cause is CWE-367 (TOCTOU Race Condition) in the open_next_file() function within sed/execute.c. The function first calls follow_symlink() to resolve the symlink via readlink() and stores the resolved path for output, then separately calls ck_fopen() on the original symlink path (not the resolved one) to read the file — two non-atomic filesystem operations. Between these two syscalls, an attacker can atomically swap the symlink to a different target, causing sed to read from the attacker-chosen file while writing the processed output to the originally resolved path. The one-line fix changes ck_fopen(name, ...) to ck_fopen(input->in_file_name, ...), ensuring the already-resolved path is opened for reading. The bug was introduced in sed 4.1e and reportedly reproduces reliably in approximately 14 attempts (oss-security, GitHub Advisory).

Successful exploitation allows an attacker to perform arbitrary file overwrites with attacker-controlled content in the context of the sed process. The primary risk is to system integrity — if a privileged process (e.g., running as root) invokes sed -i --follow-symlinks on a path the attacker can influence, the attacker could overwrite sensitive system files, potentially enabling privilege escalation. There is no confidentiality or availability impact; the attack is limited to unauthorized file modification (oss-security, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.004–0.006%, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, the ability to create or manipulate symlinks in a directory where a privileged sed operation is performed, and precise timing to win the race window (GitHub Advisory, oss-security).

1. Reconnaissance: Identify systems where a privileged process (e.g., a cron job or script running as root) invokes sed -i --follow-symlinks on a path within a directory writable by the attacker.
2. Setup symlink: In the writable directory, create a symlink pointing to a benign file that the privileged sed process will process (e.g., ln -s /tmp/benign.txt target_link).
3. Prepare malicious content: Stage a file with attacker-controlled content at a chosen path (e.g., /tmp/malicious_content).
4. Race the window: Continuously and rapidly replace the symlink atomically between the two sed syscalls — after readlink() resolves the original target but before ck_fopen() opens the symlink — using a loop such as: while true; do ln -sfn /tmp/malicious_content target_link; ln -sfn /tmp/benign.txt target_link; done.
5. Trigger overwrite: When the race is won, sed reads from /tmp/malicious_content (the new symlink target) and writes the processed result to the originally resolved path (the benign file's location), achieving arbitrary file overwrite with attacker-controlled content in the context of the sed process (oss-security).

• File System: Unexpected modification timestamps on sensitive files (e.g., /etc/passwd, /etc/sudoers, cron files) coinciding with sed invocations; presence of symlinks in directories processed by privileged sed scripts that point to unexpected targets.
• Logs: System or application logs showing sed invocations with both -i and --follow-symlinks flags on paths in world-writable or attacker-accessible directories; audit logs (auditd) recording rapid symlink creation/replacement (symlink, rename syscalls) in directories processed by sed.
• Process: Privileged sed processes (sed running as root) observed operating on symlinks in user-writable directories; unusual file content changes in root-owned files immediately following sed execution.

Upgrade GNU sed to version 4.10 or later, which contains a one-line fix that opens the already-resolved symlink path for reading rather than re-traversing the original symlink. As a workaround until patching is possible, avoid using sed with both -i and --follow-symlinks together, especially in scripts running with elevated privileges on paths accessible to untrusted users. Restrict symlink creation permissions in directories where privileged sed operations are performed. Distribution-specific updates have been released by SUSE, openSUSE, Ubuntu, and Mageia (oss-security, GitHub Advisory).

The vulnerability was coordinated through CERT Polska and the linux-distros mailing list prior to public disclosure. Solar Designer of Openwall noted on oss-security that Gentoo and Amazon failed to complete their contributing-back tasks (public disclosure notification), and that the issue was considered "too minor" to warrant the full distros list. The GNU sed maintainer Jim Meyering handled disclosure responsibly, releasing sed 4.10 with the fix on April 21, 2026. Multiple Linux distributions including SUSE, openSUSE, Ubuntu, and Mageia issued security advisories and updated packages (oss-security).