CVE-2019-12761

CVE-2019-12761 affects PyXDG prior to 0.26. A code injection issue arises via crafted Python in a Category element of a Menu XML (.menu) file, triggered when XDG_CONFIG_DIRS leads to xdg.Menu.parse. Root cause is lack of sanitization before an eval call in xdg/Menu.py. Various advisories (Debian,...

CVE-2014-1624

The CVE-2014-1624 issue affects python-xdg 0.25 and is a TOCTOU race condition in get_runtime_dir that can enable local users to overwrite arbitrary files by pre-creating a temp path and then replacing it with a symlink to an attacker-controlled location. Public entries confirm the vulnerable com...