OS Command Injection Vulnerability in Fluxbox by Fluxbox Development Team

CVE-2026-123784

What is CVE-2026-123784?

Fluxbox versions up to 1.3.7 are vulnerable to an OS command injection issue in the RootTheme::reconfigTheme() function. This vulnerability allows attackers to execute arbitrary commands by injecting shell metacharacters into background values of style configurations. Specifically, the threat arises when crafted style background values containing these metacharacters are processed unescaped, leading to the execution of potentially harmful commands through the fbsetbg command run via $SHELL -c when the style is applied. This poses a significant risk as attackers could manipulate the theme configuration to gain unauthorized access or control over the system.

References