CVE-2021-41149: Improper sanitization of target names in tough

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-19 · updated 2026-06-17
Weakness: CWE-22

Description

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.

Affected products

AWS tough: before 0.12.0 — fixed in 0.12.0

How to fix

Upgrade to a fixed version: AWS tough 0.12.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41149 or the next vulnerability affects your stack