{"id":"CVE-2022-41138","aliases":["DEBIAN-CVE-2022-41138","EUVD-2022-44379","GHSA-56cx-5f5p-v4rv","UBUNTU-CVE-2022-41138","USN-8078-1"],"status":"published","title":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02264,"percentile":0.83152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2022-09-20T17:01:10Z","modified":"2026-10-15T08:01:58Z","fixes":[{"ecosystem":"Debian:12","package":"zutty","fixed_in":["0.13.0.20220910.112547+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zutty","fixed_in":["0.13.0.20220910.112547+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zutty","fixed_in":["0.13.0.20220910.112547+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zutty","fixed_in":["0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zutty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0.20220910.112547+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zutty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0.20220910.112547+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zutty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0.20220910.112547+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zutty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["0.10.20211016.133334+dfsg1-1","0.11.2.20220109.192032+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zutty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["0.10.20211016.133334+dfsg1-1","0.11.2.20220109.192032+dfsg1-1"]}],"products":[{"vendor":"zutty_project","product":"zutty"}],"references":[{"url":"https://github.com/tomszilagyi/zutty/commit/bde7458c60a7bafe08bbeaafbf861eb865edfa38","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugs.gentoo.org/868495","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/tomszilagyi/zutty/compare/0.12...0.13","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202209-25","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41138"},{"url":"https://github.com/advisories/GHSA-56cx-5f5p-v4rv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-41138","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-41138","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41138","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8078-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41138","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-20T17:01:10Z","modified":"2025-05-29T13:33:48.574Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-44379","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-20T17:01:10Z","modified":"2025-05-29T13:33:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:36.215224Z"}],"ghsa":[{"id":"GHSA-56cx-5f5p-v4rv","title":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-21T00:00:39Z","modified":"2025-05-29T15:31:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:02:29.606493Z"}],"nvd":[{"id":"CVE-2022-41138","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-20T18:15:10.69Z","modified":"2026-06-17T05:02:40.05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-41138","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-20T18:15:10.69Z","modified":"2026-04-02T08:18:20.079056Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"UBUNTU-CVE-2022-41138","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-20T18:15:00Z","modified":"2026-03-09T11:24:33.026241Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"DEBIAN-CVE-2022-41138","description":"In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.","status":"published","published":"2022-09-20T18:15:10.69Z","modified":"2026-11-03T06:02:57.930881727Z","updated_at":"2026-11-03T06:43:19.563245Z"},{"id":"USN-8078-1","title":"zutty vulnerability","description":"Carter Sande discovered that Zutty did not correctly echo invalid input to\nthe console on DECRQSS. An attacker could possibly use this issue to\nexecute arbitrary commands.","status":"published","published":"2026-03-05T22:17:18Z","modified":"2026-04-27T18:41:38.942913Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}