CVE-2021-27135: xterm flaw may allow remote code execution, CVSS 9.6

Re:CVE-2021-27135: xterm flaw may allow remote code executio... by syzzer on Saturday March 20, 2021 @02:31PM (#26524997)

> Upload a package to PyPI or Node.js that emits specially crafted console output as part of its installer.

If someone runs my installer without checking the contents, why would I need UTF-8 bugs to get code executed?

(Not meant to downplay this bug, but the example made me wonder...)

[ Parent | on HN ]

Re:CVE-2021-27135: xterm flaw may allow remote code executio... by pengaru on Saturday March 20, 2021 @02:36PM (#26525037)

The host running the installer is often not the same as the one running the terminal emulator. Guess which is more likely to have keys to kingdoms?

[ Parent | on HN ]

Re:CVE-2021-27135: xterm flaw may allow remote code executio... by kstrauser on Saturday March 20, 2021 @02:39PM (#26525061)

Fair, so let’s skip the installation step and put the poison characters in its README so that `npm show hackerpackage` does the trick. Now installation isn’t necessary.

[ Parent | on HN ]