CVE-2019-12761

Vulnerability

Description

CVE-2019-12761 is a code injection vulnerability in PyXDG versions prior to 0.26. The flaw exists in the xdg/Menu.py module, which handles the parsing of .menu XML files according to the freedesktop.org Menu Specification. The root cause is the lack of sanitization of the Category element content before it is passed to Python's eval() function. An attacker can embed arbitrary Python code within a Category element, which will be executed when the menu is parsed [1][2].

Exploitation

Conditions

Exploitation requires the attacker to control a .menu file whose Category element contains crafted Python code. The file must be placed in a directory that is part of the XDG_CONFIG_DIRS environment variable, causing xdg.Menu.parse() to process it. No authentication is required, but the victim must either be tricked into running an application that parses such a menu file or the attacker must be able to write to a location scanned by the XDG menu system. A proof-of-concept using __import__('os').system() demonstrates successful command execution [2][3].

Impact

Successful exploitation allows arbitrary code execution in the context of the user or application that triggers the menu parsing. An attacker could execute system commands, install malware, escalate privileges, or steal sensitive data. The vulnerability is particularly dangerous because it can be triggered without explicit user interaction beyond running a desktop environment or tool that reads XDG menus [1][4].

Mitigation

Status

The vulnerability has been fixed in PyXDG version 0.26. Users should upgrade immediately. No workarounds are known; removing untrusted .menu files from XDG_CONFIG_DIRS paths can reduce risk but is not a complete solution. The vulnerability is tracked in the PyPI advisory database (PYSEC-2019-199) [4].