Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

below

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3crates.ioPublished

    Below has Incorrect Permission Assignment for Critical Resource

    CVE-2025-27591 · GHSA-9mc5-7qhg-fp3w

    Affected
    • crates.io below < 0.9.0
    Fixed in
    0.9.0· Vendor fix available
    Issue
    Impact A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow. Patches https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83 This is included in version 0.9.0 Workarounds Change the permission on /var/log/below manually References https://www.facebook.com/security/advisories/cve-2025-27591 https://www.cve.org/CVERecord?id=CVE-2025-27591

    Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →