CVE-2026-123784 · Package
NO FIX YET · SEE WHAT TO DO
Fluxbox, a window manager for Linux and BSD desktops, builds a shell command from theme style values without escaping them. A malicious style file with shell metacharacters in background paths or gradient text makes the desktop run attacker-chosen commands when the style loads.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only systems running the Fluxbox window manager with a style file from an untrusted source are exposed, since the flaw is in how the style's background and gradient values reach a shell. Servers without a desktop session and users who only use their own styles can skip it.
Not affected if no-fluxbox, own-styles-only
Who cares bsd-desktop, fluxbox, linux-desktop
fluxbox -version or your package manager and compare it to the fixed release in the product ranges.~/.fluxbox/styles or shared style directories that the user did not write.1.3.7; the sources do not name the exact fixed version. See the linked patch on github.com.Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.