CVE-2012-5534

The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote...

7.5 HighFix available

The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."

Exploit likelihood

4.44%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2012-5534
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-5534
Updated: 2026-11-02

EUVDEUVD-2012-5426 No score

Record: EUVD-2012-5426
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q88q-j4pq-r9xg No score

The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote...

Record: GHSA-q88q-j4pq-r9xg
Weakness: CWE-20
Updated: 2026-11-02

OSV No score

Record: CVE-2012-5534
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-5534 No score

Record: DEBIAN-CVE-2012-5534
Updated: 2026-11-02

Affected products

flashtux weechat

Affected packages

Affected packages
Package	Affected	Fixed
`weechat` Debian:12	before 0.3.9.2-1	0.3.9.2-1
`weechat` Debian:13	before 0.3.9.2-1	0.3.9.2-1
`weechat` Debian:14	before 0.3.9.2-1	0.3.9.2-1
`weechat` Debian:6.0	before 0.3.2-1+squeeze1, plus listed versions 0.3.2-1	0.3.2-1+squeeze1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5534 is a high vulnerability (CVSS 7.5) in Flashtux Weechat, published December 3, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.44%, the 91st percentile. Fixed in weechat 0.3.9.2-1.

References

Show 12 moreShow less