Astra Linux – Vulnerability in pyxdg

A code injection issue was discovered in PyXDG before version 0.26, through crafted Python code within a Category element of a Menu XML document in a .menu file. The XDGCONFIGDIRS setting must be configured to trigger the xdg.Menu.parse parsing within the directory containing this file. This issu...

USN-4700-1 pyxdg vulnerability

Alexandre D'Hondt discovered that PyXDG did not properly sanitize input. An attacker could exploit this with a crafted .menu file to execute arbitrary code...

Code Injection

pyxdg is vulnerable to code injection. The vulnerability is due to lack of sanitization of xdg/Menu.py before an eval call, allowing an attacker to perform xdg.Menu.parse parsing within the directory containing this file by using a malicious python code via a Category element of a Menu XML docume...