{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123784", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T14:37:46.094Z", "datePublished": "2026-11-06T15:01:00.678Z", "dateUpdated": "2026-11-11T03:06:39.965Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-06T15:01:00.678Z"}, "datePublic": "2026-11-01T00:00:00.000Z", "title": "Fluxbox through 1.3.7 OS Command Injection via Style Background Values", "descriptions": [{"lang": "en", "value": "Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "fluxbox", "product": "fluxbox", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.3.7", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/fluxbox/fluxbox"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/fluxbox/fluxbox/pull/89", "tags": ["issue-tracking", "patch"], "name": "Pull Request #89"}, {"url": "https://github.com/fluxbox/fluxbox", "tags": ["product"]}, {"url": "https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f", "name": "Fix commit 270bfbc", "tags": ["patch"]}, {"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264", "name": "RootTheme::reconfigTheme", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Fluxbox through 1.3.7 OS Command Injection via Style Background Values", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values"}], "credits": [{"lang": "en", "value": "Igor Marcel", "type": "finder"}, {"lang": "en", "value": "Mathias Gumz", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-11T03:06:30.379337Z", "id": "CVE-2026-123784", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-11T03:06:39.965Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/fluxbox/fluxbox", "product": "fluxbox", "vendor": "fluxbox", "versions": [{"lessThanOrEqual": "1.3.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads."}], "id": "CVE-2026-123784", "lastModified": "2026-11-11T05:19:33.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123784", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-11T03:06:30.379337Z", "version": "2.0.3"}}]}, "published": "2026-11-06T15:17:21.297", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox/pull/89"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fluxbox: fluxbox: Arbitrary command execution via crafted style background values", "id": "2568284", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568284"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.", "A flaw was found in Fluxbox. This vulnerability allows an attacker to execute arbitrary commands by convincing a user to load a specially crafted style file. When processing the style, unescaped background configuration values are passed directly to a system shell command, leading to command execution with the privileges of the victim."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to eliminate shell invocation in Fluxbox when applying styles by spawning fbsetbg directly via execvp instead of executing through a shell: upgrade to the fixed Fluxbox builds, which execute fbsetbg directly via execvp without invoking a shell and rebuild gradient arguments from parsed texture flags instead of raw style text, closing all 3 injection vectors (crafted background pixmap path, crafted random mode directory path, crafted gradient texture string). Until patched, this is only a concern on Linux systems running the Fluxbox window manager where users load custom style or theme files \u2014 Standard Red Hat enterprise deployments using default desktop environments without Fluxbox installed are unaffected \u2014 so Do not load untrusted or third-party Fluxbox style and theme files, and restrict write access to local style directories. As a compensating measure, audit and log execve syscalls when commands are spawned from Fluxbox via the shell using auditd, detect unexpected shell executions and commands spawned by the Fluxbox process using Falco eBPF probes, restrict the actions and file access of commands spawned by the Fluxbox process using SELinux in enforcing mode, confine the execution capabilities and privileges of logged-in users running Fluxbox using SELinux confined user mappings, and detect anomalous child shell and process execution spawned from the Fluxbox window manager using an EDR agent. These controls limit blast radius and contain exploitation, but they do not fix the underlying OS command injection defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)"}, "name": "CVE-2026-123784", "public_date": "2026-11-06T15:01:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123784\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123784\nhttps://github.com/fluxbox/fluxbox\nhttps://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264\nhttps://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f\nhttps://github.com/fluxbox/fluxbox/pull/89\nhttps://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values"], "statement": "This vulnerability is rated as an Important severity flaw because successful exploitation allows arbitrary command execution with the privileges of the logged-in user without requiring elevated access, though it depends on user interaction. Fluxbox is not shipped or supported in Red Hat Enterprise Linux, which uses GNOME as its default desktop environment. As a result, standard Red Hat enterprise deployments remain unaffected by this issue unless third-party packages are manually installed and configured.", "threat_severity": "Important"}