Summary
Several scripts build temp file/dir names from the process PID in the same writable directory as the final target, instead of using mktemp.
Details
scripts/vendor:74,95,112,153 — temporary="${destination}.tmp.$$" / .failed.$$scripts/library-bundle:84bin/base-bash:439 (__base_bash_libs_launcher_init_emit__) — temporary="${output_path}.base-bash-init.$$"
These scripts mkdir -p/redirect into the PID-based path before an atomic mv. This is the classic insecure-temp-file pattern (predictable name, no O_EXCL/noclobber, symlink/race exposure) that lib/bash/std/lib_std.sh deliberately avoids elsewhere via mktemp + base_std_register_cleanup_path (e.g. lib_std.sh:3251-3288) and the noclobber-guarded log sink (lib_std.sh:956-962).
Impact
A local attacker who can pre-create ${destination}.tmp.$$ (or predict/race the PID) can redirect where vendored code lands.
Suggested fix
Use mktemp -d/mktemp for these staging paths, or at minimum plain mkdir (not -p) so a pre-existing path fails closed.
Summary
Several scripts build temp file/dir names from the process PID in the same writable directory as the final target, instead of using
mktemp.Details
scripts/vendor:74,95,112,153—temporary="${destination}.tmp.$$"/.failed.$$scripts/library-bundle:84bin/base-bash:439(__base_bash_libs_launcher_init_emit__) —temporary="${output_path}.base-bash-init.$$"These scripts
mkdir -p/redirect into the PID-based path before an atomicmv. This is the classic insecure-temp-file pattern (predictable name, noO_EXCL/noclobber, symlink/race exposure) thatlib/bash/std/lib_std.shdeliberately avoids elsewhere viamktemp+base_std_register_cleanup_path(e.g.lib_std.sh:3251-3288) and the noclobber-guarded log sink (lib_std.sh:956-962).Impact
A local attacker who can pre-create
${destination}.tmp.$$(or predict/race the PID) can redirect where vendored code lands.Suggested fix
Use
mktemp -d/mktempfor these staging paths, or at minimum plainmkdir(not-p) so a pre-existing path fails closed.