CVE-2024-48990
HIGH 7.8EPSS 21.3%
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
- Affected
- needrestart
- CVSS v3.1 UBUNTU
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 21.27% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2024-11-19
- Updated
- 2025-11-03
Proof-of-concept exploits (20)
- Cyb3rFr0g/CVE-2024-48990-PoC2★ · 2024-11-24
- CyberCrowCC/CVE-2024-489900★ · 2024-12-09
- NullByte-7w7/CVE-2024-489901★ · 2024-12-19
- ally-petitt/CVE-2024-48990-Exploit5★ · 2024-11-25
- felmoltor/CVE-2024-489900★ · 2024-11-22
- makuga01/CVE-2024-48990-PoC105★ · 2024-11-20
- ns989/CVE-2024-489905★ · 2024-11-22
- pentestfunctions/CVE-2024-48990-PoC-Testing26★ · 2024-11-24
- ten-ops/CVE-2024-48990_needrestart5★ · 2025-02-16
- ProsteKubo/npm_poisoning_poc0★ · 2026-09-06
- BLUEBERRYP1LL/CVE-2024-489901★ · 2026-02-13
- Loaxert/CVE-2024-48990-PoC0★ · 2025-10-31
- Mr-DJ/CVE-2024-489901★ · 2025-10-30
- Serner77/CVE-2024-48990-Automatic-Exploit9★ · 2025-10-29
- czeti/CVE-2024-48990_needrestart5★ · 2025-02-16
- grecosamuel/CVE-2024-489900★ · 2025-12-22
- kikechans/-Linux-PrivEsc-CVE-2024-489900★ · 2026-05-11
- mladicstefan/CVE-2024-489900★ · 2025-10-28
- o-sec/CVE-2024-489902★ · 2025-12-16
- sobbing333/CVE-2024-48990-POC1★ · 2025-12-21
Metasploit modules (1)
Security advisories
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
- liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab