Loading vulnerability…
CVE-2025-8941 is a local privilege-escalation vulnerability in the linux-pam pam_namespace module. The module can improperly handle user-controlled paths in polyinstantiated directories, enabling symlink attacks and race conditions. A local unprivileged user may exploit the flaw to obtain root privileges. The fix is described as a complete fix for CVE-2025-6020.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a small “PoC CVE collection” with 3 CVE folders referenced, but only CVE-2025-11953 contains actual exploit code in the provided archive (Python + Bash). The other two CVEs (CVE-2025-59287 WSUS deserialization RCE and CVE-2025-8941 Linux-PAM pam_namespace privesc) are documentation-only here (READMEs describe additional scripts like wsus-exploit.py/pam-exploit.c, but those files are not present in the provided file list). CVE-2025-11953 exploit purpose/structure: - Target: React Native Community CLI Metro development server exposing an `open-url` HTTP endpoint. - Primitive: unauthenticated network OS command injection by POSTing JSON to `/open-url` with a crafted `url` value. - Files: - `CVE-2025-11953/exploit-basic.sh`: minimal PoC that checks reachability (GET /) then POSTs to `$TARGET/open-url` with `{"url":"$COMMAND"}`; treats HTTP 200/204 as success. - `CVE-2025-11953/exploit-advanced.py`: a more featureful exploitation tool using `requests.Session()`. - `test_connectivity()` performs GET to base target URL. - `execute_command()` posts to `{target}/open-url` and supports OS selection; Windows wraps commands with `cmd /c`. - `upload_file()` reads a local file, base64-encodes it, and writes it to an arbitrary remote path via an inlined PowerShell `WriteAllBytes` command (Windows-only). - `get_reverse_shell()` sends an inlined PowerShell reverse shell that connects back to attacker-supplied `--lhost` and `--lport` (default 4444). Output is effectively blind (no command output parsing), consistent with the README warning. Notable fingerprintable network targets/endpoints: - HTTP endpoint `/open-url` on the Metro server (commonly port 8081) is the key exploit surface. - Reverse shell callback is to attacker-controlled TCP `lhost:lport` (default port 4444). Overall, this repo is primarily an operational RCE PoC/tooling for CVE-2025-11953, packaged alongside documentation for two additional CVEs that are not actually implemented in the provided code snapshot.
This repository is a PoC collection for several recent critical CVEs, with a focus here on CVE-2025-11953 (React Native Community CLI Metro Development Server RCE). The exploit targets the '/open-url' HTTP endpoint exposed by the Metro server, which is vulnerable to OS command injection due to unsanitized input passed to the Node.js 'open' package. The repository includes both a simple Bash PoC (exploit-basic.sh) and a full-featured Python exploitation framework (exploit-advanced.py). The Python tool supports single command execution, interactive mode, reverse shell deployment (PowerShell for Windows), and file upload (Windows). The exploit is operational and can be used against Windows, Linux, and MacOS targets, provided the vulnerable Metro server is accessible over the network. The main attack vector is unauthenticated network access to the Metro server's '/open-url' endpoint (typically on port 8081). The repository is well-documented, with detailed usage instructions, mitigation advice, and detection guidance. No hardcoded IPs or domains are present; the exploit is designed to be used against user-specified targets.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A locally exploitable vulnerability affecting an AlmaLinux-related package or update, requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability. The supplied content does not identify the specific affected component or package.
A CVE referenced by the Huawei EulerOS SA-2026-3536 security advisory. The content provides no technical vulnerability details.
A vulnerability referenced by the EulerOS SA-2026-3449 security update for Huawei EulerOS UVP 2.11.1.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.