CVE-2025-59334
📋 TL;DR
Linkr versions through 2.0.0 fail to verify the integrity of .linkr manifest files, allowing attackers to inject malicious file entries into package distributions. When users extract files using a tampered manifest, the client downloads attacker-supplied files without verification, potentially leading to remote code execution. All users of Linkr versions ≤2.0.0 are affected.
💻 Affected Systems
- Linkr
📦 What is this software?
Linkr by Mohammadzain2008
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via malicious binary/script execution leading to full system compromise
Likely Case
Arbitrary file injection and potential malware installation
If Mitigated
Failed downloads or warnings when integrity checks fail
🎯 Exploit Status
Exploitation requires modifying manifest files and hosting malicious content
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.1
Vendor Advisory: https://github.com/mohammadzain2008/Linkr/security/advisories/GHSA-6wph-mpv2-29xv
Restart Required: No
Instructions:
1. Update Linkr to version 2.0.1 or later using package manager or manual installation. 2. Verify the update with 'linkr --version'. 3. Regenerate any existing .linkr manifests to include integrity checks.
🔧 Temporary Workarounds
Use only trusted manifests
allOnly download and use .linkr manifest files from trusted sources
Manual manifest verification
allManually verify manifest integrity before extraction
# Compare manifest checksums manually
# Use checksum tools like sha256sum
🧯 If You Can't Patch
- Host manifests only on trusted, secure servers with access controls
- Implement network monitoring for unexpected file downloads from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Linkr version with 'linkr --version' - if version ≤2.0.0, system is vulnerableCheck Version:
linkr --versionVerify Fix Applied:
After updating, verify version is ≥2.0.1 and test manifest extraction with integrity checking📡 Detection & Monitoring
Log Indicators:
- Failed integrity checks in Linkr logs
- Unexpected file downloads from untrusted URLs
Network Indicators:
- Downloads from suspicious/unexpected URLs during Linkr extraction
SIEM Query:
process.name:'linkr' AND network.destination.ip:(suspicious_ip_list)