{"id":"CVE-2026-123784","kind":"vulnerability","aliases":["CVE-2026-123784"],"related":[],"title":"Fluxbox: crafted style file runs shell commands when a theme loads","description":"Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.","summary":"Fluxbox, a window manager for Linux and BSD desktops, builds a shell command from theme style values without escaping them. A malicious style file with shell metacharacters in background paths or gradient text makes the desktop run attacker-chosen commands when the style loads.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bsd-desktop","fluxbox","linux-desktop","package"],"not_affected_if":["no-fluxbox","own-styles-only"],"how_to_check":"- Check the installed version with `fluxbox -version` or your package manager and compare it to the fixed release in the product ranges.\n- Look for untrusted style files in `~/.fluxbox/styles` or shared style directories that the user did not write.","fix":"- Fluxbox: move to a release newer than `1.3.7`; the sources do not name the exact fixed version. See the linked patch on github.com.","status":"open","published_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:10+00:00","updated_at":"2026-11-06T15:44:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T15:44:10Z","model":"claude-haiku-5-5","output":{"fix":"- Fluxbox: move to a release newer than `1.3.7`; the sources do not name the exact fixed version. See the linked patch on github.com.","reach":"local","title":"Fluxbox: crafted style file runs shell commands when a theme loads","impact":"high","summary":"Fluxbox, a window manager for Linux and BSD desktops, builds a shell command from theme style values without escaping them. A malicious style file with shell metacharacters in background paths or gradient text makes the desktop run attacker-chosen commands when the style loads.","audience":"businesses","category":"package","nicknames":[],"who_cares":["fluxbox","linux-desktop","bsd-desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-chosen shell commands run as the logged-in user","analyst_note":"Confirm the fixed Fluxbox version from the linked GitHub patch and check whether the attack needs a user to load a crafted style file.","how_to_check":"- Check the installed version with `fluxbox -version` or your package manager and compare it to the fixed release in the product ranges.\n- Look for untrusted style files in `~/.fluxbox/styles` or shared style directories that the user did not write.","plain_action":"","needs_analyst":true,"not_affected_if":["no-fluxbox","own-styles-only"],"who_is_affected":"Only systems running the Fluxbox window manager with a style file from an untrusted source are exposed, since the flaw is in how the style's background and gradient values reach a shell. Servers without a desktop session and users who only use their own styles can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4297,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123784':14A,17A '-2026':13A,16A '1.3.7':73C 'allow':84C 'attack':64B,85C,94C 'attacker-chosen':63B 'background':54B,92C,100C 'bsd':19B,33B 'bsd-desktop':18B 'build':35B 'c':120C 'chosen':65B 'command':7A,38B,66B,77C,88C,116C 'concaten':111C 'contain':74C 'craft':2A,90C 'cve':12A,15A 'desktop':20B,24B,34B,61B 'directori':104C 'emb':96C 'escap':44B 'execut':87C 'fbsetbg':115C 'file':4A,49B 'fluxbox':1A,21B,26B,71C 'gradient':57B,106C 'inject':78C 'linux':23B,31B 'linux-desktop':22B 'load':11A,70B,124C 'make':59B 'malici':47B 'manag':29B 'metacharact':52B,98C 'os':76C 'packag':25B 'path':55B,102C 'pixmap':101C 'random':103C 'reconfigthem':82C 'rootthem':81C 'run':5A,62B,117C 'shell':6A,37B,51B,97C,119C 'style':3A,41B,48B,69B,91C,123C 'text':58B,108C 'textur':107C 'theme':10A,40B 'unescap':112C 'valu':42B,93C 'via':89C,118C 'vulner':79C 'window':28B 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Only systems running the Fluxbox window manager with a style file from an untrusted source are exposed, since the flaw is in how the style's background and gradient values reach a shell. Servers without a desktop session and users who only use their own styles can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bsddesktop","fluxbox","high","linuxdesktop","package"],"campaign_type":null,"search_a":"'-123784':14A,17A '-2026':13A,16A 'command':7A 'craft':2A 'cve':12A,15A 'file':4A 'fluxbox':1A 'load':11A 'run':5A 'shell':6A 'style':3A 'theme':10A","search_b":"'attack':64B 'attacker-chosen':63B 'background':54B 'bsd':19B,33B 'bsd-desktop':18B 'build':35B 'chosen':65B 'command':38B,66B 'desktop':20B,24B,34B,61B 'escap':44B 'file':49B 'fluxbox':21B,26B 'gradient':57B 'linux':23B,31B 'linux-desktop':22B 'load':70B 'make':59B 'malici':47B 'manag':29B 'metacharact':52B 'packag':25B 'path':55B 'run':62B 'shell':37B,51B 'style':41B,48B,69B 'text':58B 'theme':40B 'valu':42B 'window':28B 'without':43B","search_c":"'1.3.7':73C 'allow':84C 'attack':85C,94C 'background':92C,100C 'c':120C 'command':77C,88C,116C 'concaten':111C 'contain':74C 'craft':90C 'directori':104C 'emb':96C 'execut':87C 'fbsetbg':115C 'fluxbox':71C 'gradient':106C 'inject':78C 'load':124C 'metacharact':98C 'os':76C 'path':102C 'pixmap':101C 'random':103C 'reconfigthem':82C 'rootthem':81C 'run':117C 'shell':97C,119C 'style':91C,123C 'text':108C 'textur':107C 'unescap':112C 'valu':93C 'via':89C,118C 'vulner':79C","first_public_at":"2026-11-06T15:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123784","severity":null,"published_at":"2026-11-06T15:17:21+00:00","modified_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87593,"url":"https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87594,"url":"https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}