CVE-2022-41138

In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution

Critical · published September 20, 2022

CVSS v3.1
9.8
EPSS
2%
Percentile
82.9
In the wild
Unconfirmed
What it is

🔥 A sneaky DECRQSS command in Zutty can be a hacker's ticket to arbitrary code execution! Think of it like a restaurant that lets you order a mystery ingredient without checking if it’s safe — if they serve it, you might just end up with something toxic on your plate! 🍽️ If exploited, an attacker could execute arbitrary code on the terminal, leading to absolute chaos! They could steal sensitive information, modify files, or even take over the system entirely—like a chef taking control of the kitchen with dubious intentions!

Put simply

Think of it like a restaurant that lets you order a mystery ingredient without checking if it’s safe — if they serve it, you might just end up with something toxic on your plate! 🍽️ This vulnerability allows arbitrary code execution through crafted DECRQSS commands sent to the terminal, which the system unwittingly trusts when processing inputs.

What to do

If exploited, an attacker could execute arbitrary code on the terminal, leading to absolute chaos! They could steal sensitive information, modify files, or even take over the system entirely—like a chef taking control of the kitchen with dubious intentions! Update Zutty to version 0.13 or later immediately to patch this critical flaw. Review your systems for any potentially exposed terminals that could be affected and restrict unnecessary access. 🛡️ This is fixable! Update now and you'll have your systems well-protected in no time. You've got this! 💪

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02264 · 82.9th percentile
Published
2022-09-20T17:01Z
EPSS history
Timeline
  • 20 SEP 17:01Z
    In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution
    cvelistv5