---
id: "CVE-2026-123784"
page: "https://infrastack.ai/live/CVE-2026-123784"
kind: "vulnerability"
aliases: ["CVE-2026-123784"]
title: "Fluxbox: crafted style file runs shell commands when a theme loads"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bsd-desktop", "fluxbox", "linux-desktop", "package"]
not_affected_if: ["no-fluxbox", "own-styles-only"]
published_at: "2026-11-06T15:17:21+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:44:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123784", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# Fluxbox: crafted style file runs shell commands when a theme loads

Link for people: https://infrastack.ai/live/CVE-2026-123784 (this .md is for agents)

Fluxbox, a window manager for Linux and BSD desktops, builds a shell command from theme style values without escaping them. A malicious style file with shell metacharacters in background paths or gradient text makes the desktop run attacker-chosen commands when the style loads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `fluxbox -version` or your package manager and compare it to the fixed release in the product ranges.
- Look for untrusted style files in `~/.fluxbox/styles` or shared style directories that the user did not write.

## Fix

- Fluxbox: move to a release newer than `1.3.7`; the sources do not name the exact fixed version. See the linked patch on github.com.

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123784

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values
- [fix] Patch: github.com https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f

## From the sources

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_