CVE-2023-43091
Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
CVE-2023-43091- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-47512
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
EUVD-2023-47512- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jrf-4f89-74jx
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service...
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
GHSA-8jrf-4f89-74jx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
NVD
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
CVE-2023-43091- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
OSV
Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
CVE-2023-43091- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-43091
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
DEBIAN-CVE-2023-43091- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-43091
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
- Record
UBUNTU-CVE-2023-43091- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-mapsDebian:12 |
All versions, plus listed versions 43.4-143.5-143.5-243.5-2~deb12u144.0-1 Show 45 moreShow less44.1-144.2-144.3-144.3-244~beta-144~rc-145.0-145.1-145.2-145.3-145.4-145~beta-145~beta-245~rc-146.0-146.10-146.11-146~beta-147.0-147.1-147.2-147.3-147~beta-148.0-148.1-148.2-148.3-148.4-148.4-248.5-148.6-148.6-248.6-348.7-148.7-248~beta-148~rc-149.0-149.1-149.2-149.3-149.5-150.0-150.1-150.2-1 |
None known |
gnome-mapsDebian:13 |
before 45~rc-1 | 45~rc-1 |
gnome-mapsDebian:14 |
before 45~rc-1 | 45~rc-1 |
gnome-mapsUbuntu:16.04:LTS |
All versions, plus listed versions 3.16.2-1ubuntu13.18.1-23.18.2-13.18.3-0ubuntu13.18.4-0ubuntu1 |
None known |
gnome-mapsUbuntu:18.04:LTS |
All versions, plus listed versions 3.26.1-13.26.2-13.26.2-23.26.2-33.27.90-13.27.92-13.28.0-13.28.1-1 |
None known |
gnome-mapsUbuntu:20.04:LTS |
All versions, plus listed versions 3.34.1-13.35.90-13.36.0-13.36.1-13.36.1-1ubuntu1 |
None known |
gnome-mapsUbuntu:22.04:LTS |
All versions, plus listed versions 40.5-141.0-1build141.1-141.2-141.4-142.0-142.1-0ubuntu142.3-0ubuntu1 |
None known |
gnome-mapsUbuntu:24.04:LTS |
All versions, plus listed versions 45.0-145.1-145.2-145.3-145.4-146~beta-146.0-146.0-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-43091 is a critical vulnerability (CVSS 9.8) in Gnome Gnome-maps, published November 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in gnome-maps 45~rc-1.
References
bugzilla.redhat.com/show_bug.cgi?id=2239091
gitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4bea
nvd.nist.gov/vuln/detail/CVE-2023-43091
github.com/advisories/GHSA-8jrf-4f89-74jx
Left out here: 4 versions. The JSON record has them.