CVE-2026-13412
Security update for joe
No scoreFix available
This update for joe fixes the following issue
- CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution (bsc#1269379).
What each source reports
OSVopenSUSE-SU-2026:11293-1 No score
joe-4.6-4.1 on GA media
These are all security issues fixed in the joe-4.6-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11293-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21408-1 No score
Security update for joe
This update for joe fixes the following issue
- CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution (bsc#1269379).
- Record
openSUSE-SU-2026:21408-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22843-1 No score
Security update for joe
This update for joe fixes the following issue
- CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution (bsc#1269379).
- Record
SUSE-SU-2026:22843-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3108-1 No score
Security update for joe
This update for joe fixes the following issue
- CVE-2026-13412: arbitrary command execution via malicious tags file (bsc#1269379).
- Record
SUSE-SU-2026:3108-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3196-1 No score
Security update for joe
This update for joe fixes the following issue
- CVE-2026-13412: arbitrary command execution via malicious tags file (bsc#1269379).
- Record
SUSE-SU-2026:3196-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
joeSUSE:Linux Enterprise Server 16.0 |
before 4.6-160000.4.1 | 4.6-160000.4.1 |
joeSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 4.6-160000.4.1 | 4.6-160000.4.1 |
joeSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.4-150000.3.3.1 | 4.4-150000.3.3.1 |
joeSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 3.7-30.3.1 | 3.7-30.3.1 |
joeSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 3.7-30.3.1 | 3.7-30.3.1 |
joeopenSUSE:Tumbleweed |
before 4.6-4.1 | 4.6-4.1 |
joeopenSUSE:Leap 16.0 |
before 4.6-160000.4.1 | 4.6-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-13412 is a vulnerability with no CVSS score yet in joe, published July 17, 2026. No source lists public exploit code. Fixed in joe 4.6-160000.4.1.