{"id":"CVE-2013-1436","aliases":["DEBIAN-CVE-2013-1436","EUVD-2013-1474","GHSA-w6w5-x32x-cg2w","HSEC-2023-0003","UBUNTU-CVE-2013-1436"],"status":"published","title":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to...","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08985,"percentile":0.95297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2014-10-06T23:00:00Z","modified":"2026-09-01T20:03:15Z","exploits":[{"source":"exploitdb","id":"EDB-38680","title":"xmonad XMonad.Hooks.DynamicLog Module - Multiple Remote Command Injection Vulnerabilities","type":"remote","platform":"linux","date":"2013-07-26","verified":true,"url":"https://www.exploit-db.com/exploits/38680"}],"fixes":[{"ecosystem":"Debian:12","package":"xmonad-contrib","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmonad-contrib","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmonad-contrib","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Hackage","package":"xmonad-contrib","fixed_in":["0.11.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xmonad-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmonad-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmonad-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Hackage","package":"xmonad-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5"},{"fixed":"0.11.2"}]}],"versions":["0.10","0.11","0.11.1","0.5","0.6","0.7","0.8","0.8.1","0.9","0.9.1","0.9.2"]}],"products":[{"vendor":"xmonad","product":"xmonad-contrab"}],"references":[{"url":"http://www.securityfocus.com/bid/61491","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","evidence"]},{"url":"http://security.gentoo.org/glsa/glsa-201405-28.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/07/26/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence","discussion"]},{"url":"http://handra.rampa.sk/dawb/patch?repoPURL=http%3A%2F%2Fcode.haskell.org%2FXMonadContrib\u0026repoPHash=20130708144813-1499c-0c3e284d3523c0694b9423714081761813bc1e89","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1436"},{"url":"https://github.com/advisories/GHSA-w6w5-x32x-cg2w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1436","tags":["advisory"]},{"url":"https://security.gentoo.org/glsa/201405-28","tags":["advisory"]},{"url":"https://github.com/xmonad/xmonad-contrib/commit/d3b2a01e3d01ac628e7a3139dd55becbfa37cf51","tags":["fix"]},{"url":"https://ubuntu.com/security/CVE-2013-1436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1436","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-1436","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"published","published":"2014-10-06T23:00:00Z","modified":"2024-08-06T15:04:48.667Z","updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2013-1474","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"published","published":"2014-10-06T23:00:00Z","modified":"2024-08-06T15:04:48Z","updated_at":"2026-11-03T01:56:42.411756Z"}],"ghsa":[{"id":"GHSA-w6w5-x32x-cg2w","title":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to...","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"published","published":"2022-05-17T04:31:37Z","modified":"2023-01-28T05:02:00Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:43:41.215266Z"}],"nvd":[{"id":"CVE-2013-1436","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"published","published":"2014-10-06T23:55:05.53Z","modified":"2026-06-16T23:51:25.987Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:51.408338Z"}],"osv":[{"id":"CVE-2013-1436","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"published","published":"2014-10-06T23:55:05Z","modified":"2026-04-10T03:43:17.762521Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1436","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"published","published":"2014-10-06T23:55:05.53Z","modified":"2026-09-01T20:03:15.34234143Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"HSEC-2023-0003","title":"code injection in xmonad-contrib","description":"# code injection in *xmonad-contrib*\n\nThe `XMonad.Hooks.DynamicLog` module in _xmonad-contrib_ before\n**0.11.2** allows remote attackers to execute arbitrary commands via a\nweb page title, which activates the commands when the user clicks on\nthe xmobar window title, as demonstrated using an action tag.\n","status":"published","published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:33.129091Z","updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2013-1436","description":"The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.","status":"withdrawn","published":"2014-10-06T23:55:00Z","modified":"2025-07-16T07:31:10.288085Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}