CVE-2025-5962
Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
- Record
CVE-2025-5962- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2025-30787
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
- Record
EUVD-2025-30787- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3c94-6m3r-2frp
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local,...
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
- Record
GHSA-3c94-6m3r-2frp- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
- Record
CVE-2025-5962- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVRHSA-2025:16345
Red Hat Security Advisory: command-line-assistant security update
- Record
RHSA-2025:16345- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2025:16346
Red Hat Security Advisory: command-line-assistant security update
- Record
RHSA-2025:16346- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
command-line-assistantRed Hat:enterprise_linux:10.0 | before 0:0.3.1-6.el10_0 | 0:0.3.1-6.el10_0 |
command-line-assistant-selinuxRed Hat:enterprise_linux:10.0 | before 0:0.3.1-6.el10_0 | 0:0.3.1-6.el10_0 |
command-line-assistantRed Hat:enterprise_linux:9::appstream | before 0:0.3.1-6.el9_6 | 0:0.3.1-6.el9_6 |
command-line-assistant-selinuxRed Hat:enterprise_linux:9::appstream | before 0:0.3.1-6.el9_6 | 0:0.3.1-6.el9_6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-5962 is a high vulnerability (CVSS 7.7) in Red Hat Enterprise Linux 10, published September 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in command-line-assistant 0:0.3.1-6.el10_0.