CVE-2023-41057

CVE-2023-41057 is a path traversal vulnerability in the hyper-bump-it command-line tool (versions prior to 0.5.1). An attacker could craft a malicious configuration file to cause hyper-bump-it to write changes to files outside of the intended project directory, potentially leading to data integrity issues. The vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring user interaction, and resulting in high impact to integrity. There is no impact on confidentiality or availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Users are advised to upgrade to version 0.5.1 or use the --interactive command-line argument as a mitigation.