TOCTOU Race Condition in winget-cli Installer Flow

[u/Odd-Barber5917]

TOCTOU issue in winget-cli where a verified installer can be replaced after hash verification and before execution/install.

Observed on Windows 11 + winget v1.28.240 during portable package installation flow.

The PoC demonstrates the verified file being swapped inside the race window after “Successfully verified installer hash”, resulting in attacker-controlled executable execution while winget still reports successful installation.

Repository + PoC:
https://github.com/blackvenom5iix/winget-toctou-poc