Code Injection Vulnerability in PyXDG Affects Multiple Configurations
CVE-2019-12761

7.5HIGH

Key Information:

Vendor: Python
Status: Pyxdg
Vendor: CVE Published:; 6 June 2019

What is CVE-2019-12761?

A code injection issue exists in the PyXDG library before version 0.26. This vulnerability can be exploited via specifically crafted Python code embedded in the Category element of Menu XML documents found in .menu files. The flaw arises from inadequate input sanitization in the xdg/Menu.py module prior to calling the eval function. To trigger this vulnerability, the XDG_CONFIG_DIRS environment variable must be configured to lead xdg.Menu.parse to inspect the directory containing the affected files.