High severity7.8NVD Advisory· Published Nov 6, 2026

CVE-2026-123784

Description

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fluxbox Team/Fluxbotllm-fuzzy
Range: <=1.3.7

Patches

Vulnerability mechanics

References

github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.ccnvd
github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889fnvd
github.com/fluxbox/fluxbox/pull/89nvd
www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-valuesnvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000