https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 08:13:06 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118692 <p>CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.</p> <p>CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118692 https://db.gcve.eu/vuln/ghsa-3v3v-qqf5-5rqr <p>CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.</p> <p>CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.</p> https://db.gcve.eu/vuln/ghsa-3v3v-qqf5-5rqr https://db.gcve.eu/vuln/ubuntu-cve-2026-118692 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cherrytree, Ubuntu:18.04:LTS: cherrytree, Ubuntu:22.04:LTS: cherrytree, Ubuntu:24.04:LTS: cherrytree, Ubuntu:26.10: cherrytree, Ubuntu:26.04:LTS: cherrytree</p> <p>CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cherrytree, Ubuntu:18.04:LTS: cherrytree, Ubuntu:22.04:LTS: cherrytree, Ubuntu:24.04:LTS: cherrytree, Ubuntu:26.10: cherrytree, Ubuntu:26.04:LTS: cherrytree</p> <p>CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-118692