VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Apr 27, 2024· Updated Apr 15, 2026

CVE-2023-1000

CVE-2023-1000

Description

A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
dcnntPyPI
< 0.9.10.9.1

Patches

2
b4021d784a97

Fix command ijection vulnerability

https://github.com/cyanomiko/dcnnt-pyAsciiMothAug 14, 2023via ghsa
commit
1 file changed · +2 −1
  • dcnnt/plugins/notifications.py+2 −1 modified
    @@ -1,5 +1,6 @@
 import logging
 import subprocess
+from shlex import quote
 
 from .base import Plugin
 from ..common import *
@@ -53,6 +54,6 @@ def main(self):
                         except Exception as e:
                             self.log(e, logging.WARNING)
                     icon = icon_path if icon_data else ''
-                    command = cmd.format(uin=uin, name=name, icon=icon, text=text, title=title, package=package)
+                    command = cmd.format(uin=quote(uin), name=quote(name), icon=quote(icon), text=quote(text), title=quote(title), package=quote(package))
                     self.log('Execute: "{}"'.format(command))
                     subprocess.call(command, shell=True)
5dd411ab7e9e
https://github.com/cyanomiko/dcnnt-pyvia osv

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

7

News mentions

0

No linked articles in our index yet.