Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-26 15:30 UTC
Importiert: 2026-08-30 07:28 UTC
Quelle-ID: full_disc
uid_hash: f1b2051c9956b0102b2f008a699de47f8ec06c9269b35839f88f73013295d89e

Full Disclosure

Posted by Ron E on Aug 26 An OS command injection vulnerability exists in the Escargot

v4.3.0-214-gfaee4437 crash handler due to an executable/module path being

incorporated into an addr2line shell command without quoting or escaping.

The resulting command is executed using system(), causing shell

metacharacters contained within the path to be interpreted as command

syntax.

By launching Escargot using a crafted executable path containing shell

metacharacters and...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss