Every CVE Search/ Get API key

CVE-2023-1350

liferea Feed Enrichment update.c update_job_run os command injection

6.3 MediumFix available

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.30%Up 2.3 points since Mar 12, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.3

liferea Feed Enrichment update.c update_job_run os command injection

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
CVE-2023-1350
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2023-23608 6.3

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
EUVD-2023-23608
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-9q9p-r5vc-g557 9.8

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is...

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
GHSA-9q9p-r5vc-g557
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 6.3

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
CVE-2023-1350
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-78
Updated
2026-11-02
OSV 6.3

liferea Feed Enrichment update.c update_job_run os command injection

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
CVE-2023-1350
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-78
Updated
2026-11-02
OSVDEBIAN-CVE-2023-1350 9.8

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
DEBIAN-CVE-2023-1350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-1350 6.3

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Record
UBUNTU-CVE-2023-1350
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2023-0103 No score

Updated liferea packages fix security vulnerability

Remote code execution on feed enrichment. If "Extract full content from HTML5 and Google AMP" has been enabled for one or more feed subscriptions it is possible for a an attacker to inject a script command that runs with user priveleges. (CVE-2023-1350)

Record
MGASA-2023-0103
Updated
2026-11-02
OSVopenSUSE-SU-2023:0096-1 No score

Security update for liferea

liferea was updated to version 1.14.1:

  • Fix CVE-2023-1350 - Remote code execution on feed enrichment (boo#1209190).

Update to version 1.14.0:

  • New 'Reader mode' preference that allows stripping all web content
  • Implement support for Webkits Intelligent Tracking Protection
  • New progress bar when loading websites
  • Youtube videos from media:video can be embedded now with a click on the video preview picture.
  • Changes to UserAgent handling: same UA is now used for both feed fetching and internal browsing.
  • New view mode 'Automatic' which switches between 'Normal' and 'Wide' mode based on the window proportions.
  • Liferea now supports the new GTK dark theme logic, where in the GTK/GNOME preferences you define wether you 'prefer' dark mode or light mode
  • Favicon discovery improvements: now detects all types of Apple Touch Icons, MS Tile Images and Safari Mask Icons
  • Increase size of stored favicons to 128x128px to improve icon quality in 3-pane wide view.
  • Make several plugins support gettext
  • Allow mutiple feed in same libnotify notification
  • Redesign of the update message in the status bar. It now shows a update counter of the feeds being in update.
  • You can now export a feed to XML file
  • Added an option to show news bins in reduced feed list
  • Added menu option to send item per mail
  • Default to https:// instead of http:// when user doesn't provide protocol on subscribing feed
  • Implement support for subscribing to LD+Json metadata listings e.g. concert or theater event listings
  • Implement support for subscribing to HTML5 websites
  • Support for media:description field of Youtube feeds
  • Improve HTML5 extraction: extract main tag if it exists and no article was found.
  • Execute feed pipe/filter commands asynchronously
  • Better explanation of feed update errors.
  • Added generic Google Reader API support (allows using FeedHQ, FreshRSS, Miniflux...)
  • Now allow converting TinyTinyRSS subscriptions to local subscriptions
  • New search folder rule to match podcasts
  • New search folder rule to match headline authors
  • New search folder rule to match subscription source
  • New search folder rule to match parent folder name
  • New search folder property that allows hiding read items
  • Now search folders are automatically rebuild when rules are changed
  • Added new plugin 'add-bookmark-site' that allows to configure a custom bookmarking site.
  • Added new plugin 'getfocus' that adds transparency on the feed list when it is not focussed.
  • Trayicon plugin has now a configuration option to change the behaviour when closing Liferea.
  • Trayicon plugin has now an option to disable minimizing to tray
  • New hot key Ctrl-D for 'Open in External Browser'
  • New hot key F10 for headerbar plugin to allow triggering the hamburger menu
  • New hot key Ctrl-0 to reset zoom
  • New hot key Ctrl-O to open enclosures
  • Fix hidden panes, Liferea will never allow the panes to be smaller than 5% in height or width
  • Wait for network to be fully available before updating
  • 2-pane mode was removed
  • Dropped CDF channel support
  • Dropped Atom 0.2/0.3 (aka Pie) support
  • Dropped blogChannel namespace support
  • Dropped photo namespace support
  • Require python3-cairo; needed for tray icon (boo#1193579).
Record
openSUSE-SU-2023:0096-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12783-1 No score

liferea-1.14.1-1.1 on GA media

These are all security issues fixed in the liferea-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12783-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
liferea
Debian:12
 before 1.14.1-1
1.14.1-1
liferea
Debian:13
 before 1.14.1-1
1.14.1-1
liferea
Debian:14
 before 1.14.1-1
1.14.1-1
liferea
Mageia:8
 before 1.12.10-1.1.mga8
1.12.10-1.1.mga8
liferea
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.10.12-1ubuntu11.10.17-1ubuntu11.10.17-1ubuntu2
 None known
liferea
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.12~rc3-1ubuntu21.12.0-2ubuntu11.12.1-1~build11.12.1-11.12.2-1
 None known
liferea
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.12.6-11.12.7-11.12.7-1build1
 None known
liferea
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.13.5-31.13.6-21.13.7-11.13.7-21.13.7-2build1
 None known
liferea
SUSE:Package Hub 15 SP4
 before 1.14.1-bp154.2.3.1
1.14.1-bp154.2.3.1
liferea
openSUSE:Leap 15.4
 before 1.14.1-bp154.2.3.1
1.14.1-bp154.2.3.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-1350 is a medium vulnerability (CVSS 6.3) in Liferea Project Liferea, published March 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.30%, the 83rd percentile. Fixed in liferea 1.14.1-1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open