The gh-aw advisory, published November 5, describes predictable compiler temporary filenames and unsafe reuse of existing paths. Passing a nominal 0600 mode to os.WriteFile did not tighten permissions on a file that already existed; following a prepared symlink could also redirect the write. An attacker needs control of the relevant local path and timing.…
Case · DiggingBeagle record
gh-aw compilation reused predictable temporary paths without resetting permissions
A local actor able to prepare a compiler temporary path could affect its destination or retained permissions. The advisory lists a patch, but its package metadata and investigated source state should not be flattened into an invented affected range.
Public disclosure: Nov 5, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-GHAW-TMP-PERMISSIONS · Advisory: gh-aw MCP compilation status fixed .tmp filename allows symlink overwrite and world-readable report
At a glance
Predictable temporary-file reuse can violate confidentiality or integrity across workflows sharing a filesystem.
Read the implicationsNeeds local pathname control; no confirmed multi-tenant exploitation and affected version information differs across gh-aw components; use only the advisory for the exact fix range.
Limits and uncertaintyFull account
The gh-aw advisory, published November 5, describes predictable compiler temporary filenames and unsafe reuse of existing paths. Passing a nominal 0600 mode to os.WriteFile did not tighten permissions on a file that already existed; following a prepared symlink could also redirect the write.
An attacker needs control of the relevant local path and timing. The consequence remains bounded by the compiler process's filesystem permissions. This is not evidence that an unauthenticated remote user can overwrite arbitrary files or that a production secret was actually disclosed.
Keep the two version descriptions visible
The advisory metadata lists affected versions through 0.2.0 and a patched release of 1.2.0, while its technical body identifies a later investigated main-branch commit. These are different descriptions of package coverage and source state. They do not justify silently inferring that every intervening release has the same behavior.
The causal check is whether creation, ownership and destination are verified together, not whether the call site contains a restrictive mode literal. A repair must address pre-existing files and links as well as permissions on newly created files. No independent fixed-build reproduction was performed for this dossier.
Mechanism and trust boundary
- 01
A local adversary or previous workflow can prepare a same-named temporary file in a directory the workflow will later use.
- 02
The MCP compiler opens that existing path in truncate mode, inheriting its permissions and path resolution.
- 03
The compiler writes progress information to the pre-existing object before renaming it.
Claims & evidence
CLM-GHAW-TMP-PERMISSIONSThe gh-aw advisory reports that os.WriteFile did not reset permissions on existing .tmp paths despite a nominal 0600 mode argument and could follow a preplanted file.supported
Basis: reported finding
- supportsAdvisory: gh-aw MCP compilation status fixed .tmp filename allows symlink overwrite and world-readable reportprimary disclosure
GHSA-796w-fvw2-ccmp, Root cause and Patch details
Implications
Predictable temporary-file reuse can violate confidentiality or integrity across workflows sharing a filesystem.
Controls and mitigations
- Use secure exclusive temporary creation in a private directory, reject symlinks and verify file owner/permissions before materializing workflow artifacts.
Unknowns and contradictions
- Needs local pathname control; no confirmed multi-tenant exploitation and affected version information differs across gh-aw components; use only the advisory for the exact fix range.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233