TI-2026-39409 Aliases CVE-2026-54574 GHSA-9xq3-3fqg-4vg7

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

HIGH 71CWE-61Published 2026-07-29 · Updated 2026-07-29

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00214 11th percentileScored 2026-11-07

Fix Fixed proot-distro (termux): 5.1.5proot-distro (PyPI): 5.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
termux	proot-distro	before 5.1.5	5.1.5	Patch available	CNA
—	proot-distro (PyPI)	before 5.1.5	5.1.5	Patch available	GHSA-9xq3-3fqg-4vg7

proot-distro Vendortermux Affected before 5.1.5 Fixed in 5.1.5 Patch available CNA
proot-distro (PyPI) Vendor— Affected before 5.1.5 Fixed in 5.1.5 Patch available GHSA-9xq3-3fqg-4vg7

Remediation

Fix · CNA proot-distro (termux) Fixed in 5.1.5
Fix · GHSA-9xq3-3fqg-4vg7 proot-distro (PyPI) Fixed in 5.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-54574
2026-10-03 Alias added: GHSA-9xq3-3fqg-4vg7

References

Other 4

TI-2026-39540 proot-distro has a Container Isolation Bypass via Crafted Restore Archive CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences