CVE-2022-23465: SwiftTerm Code Injection vulnerability

July 14, 2023 (updated February 9, 2024)

Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user’s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.

References

github.com/advisories/GHSA-jq43-q8mx-r7mq
github.com/migueldeicaza/SwiftTerm
github.com/migueldeicaza/SwiftTerm/commit/a94e6b24d24ce9680ad79884992e1dff8e150a31
github.com/migueldeicaza/SwiftTerm/security/advisories/GHSA-jq43-q8mx-r7mq
nvd.nist.gov/vuln/detail/CVE-2022-23465

Detect and mitigate CVE-2022-23465 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →