CVE-2021-41150 Improper sanitization of delegated role names in tough

What is CVE-2021-41150?

CVE-2021-41150 is a high-severity path traversal vulnerability in awslabs tough, published on 19 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.

Weakness: CWE-22

Which versions are affected by CVE-2021-41150?

2 open source packages ship an affected version, including tough. It affects 1 product.

Products include Amazon Tough.

How do I fix CVE-2021-41150?

Upgrade tough to 0.12.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-41150 being exploited?

There is no known exploitation of CVE-2021-41150 in the wild and no public exploit code.

Other vulnerabilities in awslabs tough

• CVE-2020-15093 Improper verification of signature threshold in tough High 8.6
• CVE-2021-41149 Improper sanitization of target names in tough High 8.2
• CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough High 7.1
• CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough High 7.1
• CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles High 7.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r56q-vv3c-6g9c.