CVE-2025-64170: sudo-rs Partial Password Reveal Vulnerability
Summary
CVE-2025-64170: sudo-rs: Partial password reveal is possible after timeout. Affects sudo-rs versions >= 0.2.7, < 0.2.10. Fixed in 0.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sudo-rs is a Rust implementation of the sudo command, allowing users to execute commands with elevated privileges. It is designed to enhance security and provide a more robust alternative to traditional sudo implementations. However, a vulnerability has been identified that can lead to partial password disclosure if users do not confirm their password input within a specified timeout period.
Vulnerability Detail
The vulnerability arises when a user begins typing their password for sudo-rs but fails to press return before the password timeout occurs. After the timeout, the entered keystrokes are echoed back to the console, potentially revealing sensitive information. This could lead to exposure of partial passwords, which may be exploited through social engineering or pass-by attacks. The issue was introduced in version 0.2.7 and affects all subsequent versions until it is patched in 0.2.10.
How To Fix
Latest published version: 0.2.15 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid leaving the password prompt unattended for extended periods. Additionally, consider using alternative methods for executing commands that require elevated privileges without relying on sudo-rs until the update is applied.
Conclusion
The sudo-rs partial password reveal vulnerability (CVE-2025-64170) poses a risk of exposing sensitive password information due to timeout behavior. Users are encouraged to update to the patched version 0.2.10 and implement recommended workarounds until the update can be applied.
See every vulnerability recorded for sudo-rs →
FAQ
The vulnerability allows for partial password disclosure if the user does not confirm their password input before a timeout occurs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability affects sudo-rs versions starting from 0.2.7 up to but not including 0.2.10.
As a workaround, avoid leaving the password prompt unattended and consider using alternative methods for executing commands with elevated privileges.
The CVSS score for this vulnerability is 3.8, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sudo-rs.
