vetkit.shell.tmp.predictable-file
The script writes to a fixed file name in /tmp. Another local user can pre-create it or a symlink with that name and make the script overwrite or disclose arbitrary files.
Last updated:
Suite: Security
regex
The script writes to a fixed file name in /tmp. Another local user can pre-create it or a symlink with that name and make the script overwrite or disclose arbitrary files.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Create temporary files with mktemp (or mktemp -d) and remove them with a trap on EXIT.
References
Source: packages/engine/rules/sast/shell.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.