{"id":"GHSA-mc8h-8q98-g5hr","aliases":["RUSTSEC-2023-0018"],"url":"https://o3.security/vulnerability/GHSA-mc8h-8q98-g5hr","summary":"Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all","details":"The `remove_dir_all` crate is a Rust library that offers additional features over the Rust standard library `fs::remove_dir_all` function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.\n\nThanks to the Rust security team for identifying the problem and alerting us to it.","published":"2023-02-24T16:23:59Z","modified":"2026-09-10T03:49:52.047436844Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"remove_dir_all","fixedVersion":"0.8.0"}],"fix":{"url":"https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead","label":"XAMPPRocky/remove_dir_all@7247a8b"},"references":[{"type":"WEB","url":"https://github.com/XAMPPRocky/remove_dir_all/security/advisories/GHSA-mc8h-8q98-g5hr"},{"type":"WEB","url":"https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead"},{"type":"PACKAGE","url":"https://github.com/XAMPPRocky/remove_dir_all"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0018.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:49:52.047436844Z"}}