CVE-2013-1436
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to...
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
Exploit likelihood
What each source reports
NVD Score used
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
CVE-2013-1436- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
CVE-2013-1436- Updated
- 2026-11-02
EUVDEUVD-2013-1474 No score
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
EUVD-2013-1474- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w6w5-x32x-cg2w No score
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to...
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
GHSA-w6w5-x32x-cg2w- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
CVE-2013-1436- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1436 No score
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
DEBIAN-CVE-2013-1436- Updated
- 2026-11-02
OSVHSEC-2023-0003 No score
code injection in xmonad-contrib
code injection in xmonad-contrib
The XMonad.Hooks.DynamicLog module in xmonad-contrib before
0.11.2 allows remote attackers to execute arbitrary commands via a
web page title, which activates the commands when the user clicks on
the xmobar window title, as demonstrated using an action tag.
- Record
HSEC-2023-0003- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1436 No score
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
- Record
UBUNTU-CVE-2013-1436- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmonad-contribDebian:12 |
before 0.11.2-1 | 0.11.2-1 |
xmonad-contribDebian:13 |
before 0.11.2-1 | 0.11.2-1 |
xmonad-contribDebian:14 |
before 0.11.2-1 | 0.11.2-1 |
xmonad-contribHackage |
0.5 up to 0.11.2, plus listed versions 0.100.110.11.10.60.7 Show 5 moreShow less0.80.8.10.90.9.10.9.2 |
0.11.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | xmonad XMonad.Hooks.DynamicLog Module - Multiple Remote Command Injection Vulnerabilities | 2013-07-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1436 is a high vulnerability (CVSS 7.5) in Xmonad Xmonad-contrab, published October 6, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.98%, the 95th percentile. Fixed in xmonad-contrib 0.11.2-1.
References
securityfocus.com/bid/61491
security.gentoo.org/glsa/glsa-201405-28.xml
openwall.com/lists/oss-security/2013/07/26/5
handra.rampa.sk/dawb/patch?repoPURL=http%3A%2F%2Fcode.haskell.org%2FXMonadContrib&repoPHash=20130708144813-1499c-0c3e284d3523c0694b9423714081761813bc1e89
nvd.nist.gov/vuln/detail/CVE-2013-1436
github.com/advisories/GHSA-w6w5-x32x-cg2w