Lrzsz Before 0.13.0 Os Command Injection Via Lrz Pipe Mode

Back www.vulncheck.com

Lrzsz Before 0.13.0 Os Command Injection Via Lrz Pipe Mode

www.vulncheck.com • October 6, 2026

Share: View original

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

lrzsz 0.13.0 security changes

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lrzsz Vulnerabilities: OS Command Injection and Path Traversal Risks Two vulnerabilities have been identified in lrzsz versions prior to 0.13.0. The first, a command injection flaw (CWE-78), allows attackers to execute arbitrary OS commands via the lrz pipe mode. The second, a path traversal vulnerability (CWE-22), enables unauthorized file access through the lrz restricted mode checkpath. Both vulnerabilities could potentially be exploited by attackers to compromise systems using lrzsz. Security updates have been released to address these issues. Users are urged to upgrade to version 0.13.0 or later to mitigate risks. No has been reported as of now, but the vulnerabilities are significant enough to warrant immediate attention from system administrators. 58

Extracted Entities

CWE Weaknesses (1)

CWE-78 - OS Command Injection

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter

Vulnerabilities (1)

OS Command Injection