Description
ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and then execute it as commands.
Scores
CVSS v3
9.8
EPSS
0.0025
EPSS Percentile
48.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-116
Status
published
Products (2)
cmder/cmder
< 1.3.2
maximus5/conemu
< 22.08.07
Published
Mar 28, 2023
Tracked Since
Feb 18, 2026