OS Command Injection Vulnerability in lrzsz Utility

CVE-2026-105841

What is CVE-2026-105841?

The lrzsz utility prior to version 0.13.0 is susceptible to an OS command injection vulnerability that allows attackers to execute arbitrary commands through the use of specially crafted filenames. When the lrz receive utility operates in pipe mode, the procheader() function within its source code fails to properly escape shell metacharacters from the ZMODEM/YMODEM filenames. This oversight permits remote attackers, who send files with malicious filenames, to execute commands with the privileges of the recipient user.

References