CVE-2026-42866 — Path Traversal in Tookie OSINT

CVE: CVE-2026-42866 GHSA: GHSA-rp68-wfv6-3cq3 Severity: High CWE: CWE-22 (Path Traversal), CWE-73 (External Control of File Name or Path) Affected: Tookie OSINT v4.1 (commit 2841f43) Fixed: After disclosure via GHSA Credit: smoke-wolf (Maliq Barnard)

The bug

Tookie OSINT is a Python CLI for username enumeration across social platforms. You pass -u username and it writes results to disk as .txt, .csv, or .json.

The output writers in modules/modules.py use the username directly in the file path:

open(f"{user}.json")

No sanitization. Put ../ in the username and the output file lands wherever you want. The forced file extension limits what you can overwrite, but .json configs and .txt logs in predictable locations are fair game. The -U bulk mode reads one username per line, so a poisoned usernames file gives you N writes in one invocation.

Reproduction

$ cd /tmp/empty
$ tookie-osint -u "../../../tmp/tookie_pwned" -o json --skipheaders
$ ls -la /tmp/tookie_pwned.json
-rw-r--r-- ... 5101 bytes /tmp/tookie_pwned.json

Fix

Strip path separators from the username before building the filename, or resolve with os.path.realpath() and refuse to write outside a configured output directory.

Timeline