CVE-2017-8418: RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper wi...

Security readout for executives and security teams

This CVE concerns an unsafe temporary-file/cache handling issue in RuboCop 0.48.1 and earlier. A local user on the same machine could tamper with another user’s RuboCop cache files. The sources do not show remote exploitation, active exploitation, CVSS scoring, or broad product impact beyond RuboCop cache integrity. Most relevant to developer workstations, shared Unix hosts, or CI/build runners using RuboCop 0.48.1 or earlier. Single-user systems have lower practical exposure. The source bundle does not provide package-manager, OS, or downstream distribution details. Handle as a targeted hygiene fix, not an emergency. Raise priority if affected RuboCop versions run on shared build infrastructure or multi-user developer hosts, where cache tampering could undermine tooling integrity. Mitigation focus: Inventory RuboCop versions across developer and CI environments.; Prioritize shared hosts or shared CI runners first.; Check upstream RuboCop guidance for the fixed version or recommended workaround..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.