AIKIDO-2026-102318

TL;DR

sudo-rs resolves the file paths passed to sudoedit through a lazily evaluated iterator that is consumed twice, so each argument is canonicalized once when it is checked against the sudoers policy and again when the file is opened. A local user who is permitted to edit a specific file can replace a path component with a symbolic link in the window between these two resolutions, so the location validated against the policy differs from the location actually opened. This time-of-check to time-of-use gap lets the edit be redirected to an arbitrary path such as a file under /etc/sudoers.d, which can be leveraged for local privilege escalation. The fix collects the resolved paths into a vector so canonicalization runs once and the checked path is the one that is opened.