{"id":"CVE-2026-105841","published":"2026-10-06T14:17:41.460","lastModified":"2026-10-06T15:25:00.650","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://ohse.de/uwe/software/lrzsz.html","tags":[]},{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","tags":[]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The lrzsz library contains an OS command injection vulnerability in its receive utility that allows remote attackers to execute arbitrary commands as the receiving user when processing crafted filenames in pipe mode. This affects systems using lrz with suffixed names like lrztar.","exploitability":"Exploitation requires a remote attacker to send a specially crafted filename containing shell metacharacters to a vulnerable lrz receiver, which is moderately difficult due to the need for specific conditions including the use of suffixed binaries and pipe mode.","blast_radius":"The vulnerability could impact any system running lrz in pipe mode with suffixed binaries, potentially allowing attackers to execute commands as the receiving user with high privileges, affecting servers or systems that process file transfers from untrusted sources.","remediation":"Upgrade to lrzsz 0.13.0 or later to fix the OS command injection vulnerability in the lrz receive utility's pipe mode.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","file-transfer"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:02.732Z"}}