CVE-2026-54574: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

July 29, 2026

Repository: termux/proot-distro Component: proot_distro/commands/install.py → _extract_plain_tar(); also helpers/docker.py → _apply_layer()

References

github.com/advisories/GHSA-9xq3-3fqg-4vg7
github.com/termux/proot-distro/commit/a96d7a9667f38e45d812614852ee3915d1c0ae45
github.com/termux/proot-distro/releases/tag/v5.1.5
github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7
nvd.nist.gov/vuln/detail/CVE-2026-54574

Code Behaviors & Features

Detect and mitigate CVE-2026-54574 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →