https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T08:13:06.348784+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-118692 fkie_cve-2026-118692 2026-11-10T08:13:06.352091+00:00

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.

 https://db.gcve.eu/vuln/ghsa-3v3v-qqf5-5rqr GHSA-3v3v-qqf5-5rqr 2026-11-10T08:13:06.352245+00:00

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-118692 UBUNTU-CVE-2026-118692 2026-11-10T08:13:06.352267+00:00

Affected: Ubuntu:16.04:LTS: cherrytree, Ubuntu:18.04:LTS: cherrytree, Ubuntu:22.04:LTS: cherrytree, Ubuntu:24.04:LTS: cherrytree, Ubuntu:26.10: cherrytree, Ubuntu:26.04:LTS: cherrytree

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.