CVE-2009-4487
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might...
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Exploit likelihood
What each source reports
NVD Score used
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
- Record
CVE-2009-4487- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
- Record
CVE-2009-4487- Updated
- 2026-11-02
EUVDEUVD-2009-4454 No score
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
- Record
EUVD-2009-4454- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-94g9-mcw4-f749 No score
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might...
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
- Record
GHSA-94g9-mcw4-f749- Updated
- 2026-11-02
OSV No score
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
- Record
CVE-2009-4487- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-4487 No score
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
- Record
DEBIAN-CVE-2009-4487- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nginxDebian:12 |
All versions, plus listed versions 1.22.1-91.22.1-9+deb12u11.22.1-9+deb12u101.22.1-9+deb12u21.22.1-9+deb12u3 Show 45 moreShow less1.22.1-9+deb12u41.22.1-9+deb12u51.22.1-9+deb12u61.22.1-9+deb12u71.22.1-9+deb12u81.22.1-9+deb12u91.24.0-11.24.0-1~exp11.24.0-21.26.0-11.26.0-1~exp11.26.0-21.26.0-31.26.2-11.26.3-11.26.3-21.26.3-31.28.0-11.28.0-21.28.0-31.28.0-41.28.0-51.28.0-61.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.2-31.28.2-41.28.3-11.28.3-21.30.0-11.30.0-21.30.0-31.30.0-41.30.1-11.30.1-21.30.1-31.30.1-41.30.1-51.30.1-61.30.1-71.30.4-11.30.4-2 |
None known |
nginxDebian:13 |
All versions, plus listed versions 1.26.3-31.26.3-3+deb13u11.26.3-3+deb13u101.26.3-3+deb13u21.26.3-3+deb13u3 Show 42 moreShow less1.26.3-3+deb13u41.26.3-3+deb13u51.26.3-3+deb13u61.26.3-3+deb13u71.26.3-3+deb13u81.26.3-3+deb13u91.28.0-11.28.0-21.28.0-31.28.0-41.28.0-51.28.0-61.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.2-31.28.2-41.28.3-11.28.3-21.30.0-11.30.0-21.30.0-31.30.0-41.30.1-11.30.1-21.30.1-31.30.1-41.30.1-51.30.1-61.30.1-71.30.4-11.30.4-21.30.4-31.30.4-41.30.4-51.30.4-61.30.4-71.30.4-81.30.6-11.30.6-2 |
None known |
nginxDebian:14 |
All versions, plus listed versions 1.26.3-31.28.0-11.28.0-21.28.0-31.28.0-4 Show 32 moreShow less1.28.0-51.28.0-61.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.2-31.28.2-41.28.3-11.28.3-21.30.0-11.30.0-21.30.0-31.30.0-41.30.1-11.30.1-21.30.1-31.30.1-41.30.1-51.30.1-61.30.1-71.30.4-11.30.4-21.30.4-31.30.4-41.30.4-51.30.4-61.30.4-71.30.4-81.30.6-11.30.6-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Nginx 0.7.64 - Terminal Escape Sequence in Logs Command Injection | 2010-01-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4487 is a medium vulnerability (CVSS 6.8) in F5 Nginx, published January 13, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 26.8%, the 98th percentile. No source names a fixed version.
References
Left out here: 8 versions. The JSON record has them.