{"id":"CVE-2019-12761","aliases":["DEBIAN-CVE-2019-12761","DLA-1819-1","DLA-2727-1","EUVD-2019-0119","GHSA-r6v3-hpxj-r8rv","PYSEC-2019-199","SNYK-PYTHON-PYXDG-174562","SUSE-SU-2022:2997-1","UBUNTU-CVE-2019-12761","USN-4700-1"],"status":"published","title":"Code Injection in PyXDG","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02105,"percentile":0.81893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2019-06-06T18:55:27Z","modified":"2026-11-03T02:30:38Z","fixes":[{"ecosystem":"PyPI","package":"pyxdg","fixed_in":["0.26"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pyxdg","fixed_in":["0.26-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pyxdg","fixed_in":["0.26-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pyxdg","fixed_in":["0.26-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"pyxdg","fixed_in":["0.25-4+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"pyxdg","fixed_in":["0.25-4+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-pyxdg","fixed_in":["0.25-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyxdg","fixed_in":["0.25-4ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"pyxdg","fixed_in":["0.25-4ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pyxdg","fixed_in":["0.25-4ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4+deb8u1"}]}],"versions":["0.25-4"]},{"source":"osv","ecosystem":"Debian:9","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4+deb9u1"}]}],"versions":["0.25-4"]},{"source":"osv","ecosystem":"PyPI","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26"}]}],"versions":["0.19","0.20","0.21","0.22","0.23","0.24","0.25"]},{"source":"osv","ecosystem":"PyPI","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26"}]}],"versions":["0.19","0.20","0.21","0.22","0.23","0.24","0.25"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4ubuntu0.14.04.1~esm1"}]}],"versions":["0.25-3","0.25-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4ubuntu0.16.04.1"}]}],"versions":["0.25-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4ubuntu1.1"}]}],"versions":["0.25-4","0.25-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4ubuntu0.14.04.1~esm1"}]}],"versions":["0.25-3","0.25-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4ubuntu0.16.04.1"}]}],"versions":["0.25-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pyxdg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4ubuntu1.1"}]}],"versions":["0.25-4","0.25-4ubuntu1"]}],"products":[{"vendor":"python","product":"pyxdg"}],"references":[{"url":"https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916feba","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12761","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyxdg/PYSEC-2019-199.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r6v3-hpxj-r8rv","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12761","tags":["advisory"]},{"url":"https://github.com/takluyver/pyxdg","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222997-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1137627","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12761","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-12761","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4700-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12761","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-12761","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T18:55:27Z","modified":"2024-08-04T23:32:54.641Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-0119","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T18:55:27Z","modified":"2024-08-04T23:32:54Z","updated_at":"2026-11-03T02:40:45.434408Z"}],"ghsa":[{"id":"GHSA-r6v3-hpxj-r8rv","title":"Code Injection in PyXDG","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-07T20:56:27Z","modified":"2024-10-15T16:41:13Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2019-12761","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T19:29:00.533Z","modified":"2026-06-17T02:15:24.02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"CVE-2019-12761","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T19:29:00.533Z","modified":"2026-11-03T02:30:38.305898538Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:05:53.289262Z"},{"id":"DEBIAN-CVE-2019-12761","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T19:29:00.533Z","modified":"2026-09-21T07:00:27.503898103Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-r6v3-hpxj-r8rv","title":"Code Injection in PyXDG","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-07T20:56:27Z","modified":"2024-10-15T16:46:05.95943Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2019-12761","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T19:29:00Z","modified":"2026-02-04T02:16:26.450863Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1819-1","title":"pyxdg - security update","status":"published","published":"2019-06-16T00:00:00Z","modified":"2026-03-09T01:20:22.307104Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2727-1","title":"pyxdg - security update","status":"published","published":"2021-08-03T00:00:00Z","modified":"2026-03-09T01:23:22.392783Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"PYSEC-2019-199","description":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.","status":"published","published":"2019-06-06T19:29:00Z","modified":"2023-11-08T04:01:06.312371Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2022:2997-1","title":"Security update for python-pyxdg","description":"This update for python-pyxdg fixes the following issues:\n\n- CVE-2019-12761: Fixed a code injection issue in Category elements of\n  a Menu XML (bsc#1137627).\n","status":"published","published":"2022-09-02T10:13:46Z","modified":"2026-02-04T03:10:57.786846Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-4700-1","title":"pyxdg vulnerability","description":"Alexandre D'Hondt discovered that PyXDG did not properly sanitize input.\nAn attacker could exploit this with a crafted .menu file to execute\narbitrary code.\n","status":"published","published":"2021-01-19T14:29:18Z","modified":"2026-06-29T13:48:09.204929497Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}