Time-of-check Time-of-use (TOCTOU) Race Condition Affecting taylored package, versions <8.2.1
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-TAYLORED-10875473
- published22 Jul 2025
- disclosed27 Jun 2025
- creditLouis Nyffenegger
Introduced: 27 Jun 2025
New CVE NOT AVAILABLE CWE-367 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade taylored to version 8.2.1 or higher.
Overview
taylored is a Make changes to a branch a plugin. A command-line tool to manage and apply plugins '.taylored'. Supports applying, removing, verifying plugins, and generating them from branch (GIT).
Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the get-patch endpoint. An attacker can obtain multiple unauthorised copies of a paid patch by replaying a valid purchase token through simultaneous requests.