CVE-2026-77059

boneIO Black contains a TOCTOU race condition in the createtimedatectlsudoersfile function in boneio/webui/routes/timezonesudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race...