CVE-2026-5958: sed Race Condition Vulnerability

CVE-2026-5958 Overview

CVE-2026-5958 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in GNU sed that affects the handling of symlinks when using the -i (in-place edit) and --follow-symlinks options together. The vulnerability exists in the open_next_file() function, which performs two separate, non-atomic filesystem operations on the same path, creating a window of opportunity for an attacker to manipulate the symlink target between these operations.

Critical Impact

An attacker can exploit this race condition to achieve arbitrary file overwrite with attacker-controlled content in the context of the sed process, potentially leading to data corruption or privilege escalation scenarios on multi-user systems.

Affected Products

• GNU sed versions prior to 4.10

Discovery Timeline

• April 20, 2026 - CVE-2026-5958 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5958

Vulnerability Analysis

This vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition). The flaw manifests in the open_next_file() function when GNU sed is invoked with both -i (in-place edit) and --follow-symlinks options. The function performs two distinct filesystem operations that are not atomic:

1. First, it resolves the symlink to its target and stores the resolved path for determining where output should be written
2. Second, it opens the original symlink path (not the resolved one) to read the file contents

The time gap between these two operations creates a race window that an attacker can exploit. If the attacker atomically replaces the symlink with a different target during this window, sed will read content from the new (attacker-chosen) symlink target while writing the processed result to the path recorded in the first step.

Root Cause

The root cause of this vulnerability is the non-atomic nature of the symlink resolution and file open operations in the open_next_file() function. By separating the symlink resolution from the actual file open operation, the code introduces a race condition where the filesystem state can change between these two operations. This violates the principle of atomic operations when dealing with symbolic links, particularly in security-sensitive contexts where file paths may be controlled or influenced by untrusted users.

Attack Vector

The attack requires local access to the system where sed is being executed. An attacker must be able to manipulate symlinks in a directory where a privileged or targeted sed process is operating. The exploitation involves:

1. Identifying a scenario where sed is invoked with -i --follow-symlinks on a path the attacker can manipulate
2. Creating a symlink pointing to a benign file that the attacker controls
3. Rapidly replacing the symlink target with a different file during the race window
4. Causing sed to write processed (attacker-influenced) content to an unintended target file

The vulnerability is exploited through precise timing of symlink manipulation. An attacker would create a symlink and then rapidly swap its target between the check (symlink resolution) and use (file open) operations. This could be automated using a loop or monitoring filesystem events to time the swap precisely.

Detection Methods for CVE-2026-5958

Indicators of Compromise

• Unexpected modification timestamps on sensitive system files
• Log entries showing sed processes accessing files through symlinks in world-writable directories like /tmp
• Evidence of rapid symlink creation and deletion in directories where sed processes operate

Detection Strategies

• Monitor for sed processes using both -i and --follow-symlinks flags, particularly when operating on paths in shared or world-writable directories
• Implement file integrity monitoring (FIM) on critical system files to detect unexpected modifications
• Use process auditing to track sed invocations and their associated file operations

Monitoring Recommendations

• Enable auditd rules to log all sed process executions with their command-line arguments
• Monitor filesystem events in temporary and shared directories for suspicious symlink activity
• Implement SentinelOne's behavioral AI to detect anomalous file access patterns indicative of TOCTOU exploitation attempts

How to Mitigate CVE-2026-5958

Immediate Actions Required

• Upgrade GNU sed to version 4.10 or later where this issue has been fixed
• Avoid using the -i --follow-symlinks combination on files in directories where untrusted users have write access
• Review scripts and automation that invoke sed with in-place editing on symlinked files

Patch Information

This vulnerability was fixed in GNU sed version 4.10. Users should upgrade to this version or later to remediate the vulnerability. For more information about GNU sed, visit the GNU Sed Software Information page. Additional technical details are available in the CERT Post on CVE-2026-5958.

Workarounds

• Remove the --follow-symlinks option when using -i for in-place editing if symlink following is not strictly required
• Ensure sed operations on symlinked files are performed only in directories where the user has exclusive write access
• Use the -i option without --follow-symlinks and manually resolve symlinks before invoking sed if symlink handling is necessary

# Safe alternative: resolve symlink manually before editing
TARGET=$(readlink -f /path/to/symlink)
sed -i 's/pattern/replacement/' "$TARGET"