Skip to content
OpenAdvisories
High · 7.7 CVE-2025-5962 EUVD-2025-30787GHSA-3c94-6m3r-2frp

Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation

Published Sep 22, 2025 · Updated Jun 30, 2026 · Assigned by redhat

Description

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
RHEL 10 command-line-assistant +1 0.3.1-6.el10_0 RHSA-2025:16345
RHEL 9 command-line-assistant +1 0.3.1-6.el9_6 RHSA-2025:16346

Advisories 3

References