{"id":"CVE-2022-45145","aliases":["ALPINE-CVE-2022-45145","EUVD-2022-48059","GHSA-xvm4-qw2r-9jf6","UBUNTU-CVE-2022-45145"],"status":"published","title":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package...","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01382,"percentile":0.7234,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2022-12-10T00:00:00Z","modified":"2026-11-03T07:30:52Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"chicken","fixed_in":["5.3.0-r3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.0-r3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.0-1","4.12.0-0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1","5.3.0-1.1","5.3.0-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"chicken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-2","5.3.0-2build1"]}],"products":[{"vendor":"call-cc","product":"chicken"}],"references":[{"url":"https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","report"]},{"url":"https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=egg-compile.scm%3Bh=9ba4568113350ec75204cba55e43e27925e2d6fe%3Bhp=c1f2ceb0fb470f63c2ba2a1cf9d8d40083c2359f%3Bhb=a08f8f548d772ef410c672ba33a27108d8d434f3%3Bhpb=9c6fb001c25de4390f46ffd7c3c94237f4df92a9","tags":["x_transferred"]},{"url":"https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=NEWS%3Bh=54888afff09353093453673c407cabfe76a5ce77%3Bhp=a3fd88a892f82c8353267f50509d018bbb1934b9%3Bhb=670478435a982fc4d1f001ea08669f53d35a51cd%3Bhpb=a08f8f548d772ef410c672ba33a27108d8d434f3","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45145"},{"url":"https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=blobdiff;f=NEWS;h=54888afff09353093453673c407cabfe76a5ce77;hp=a3fd88a892f82c8353267f50509d018bbb1934b9;hb=670478435a982fc4d1f001ea08669f53d35a51cd;hpb=a08f8f548d772ef410c672ba33a27108d8d434f3","tags":["report"]},{"url":"https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=blobdiff;f=egg-compile.scm;h=9ba4568113350ec75204cba55e43e27925e2d6fe;hp=c1f2ceb0fb470f63c2ba2a1cf9d8d40083c2359f;hb=a08f8f548d772ef410c672ba33a27108d8d434f3;hpb=9c6fb001c25de4390f46ffd7c3c94237f4df92a9","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xvm4-qw2r-9jf6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-45145","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-45145","tags":["report"]},{"url":"https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commitdiff;h=a08f8f548d772ef410c672ba33a27108d8d434f3;hp=9c6fb001c25de4390f46ffd7c3c94237f4df92a9","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45145","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-45145","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","status":"published","published":"2022-12-10T00:00:00Z","modified":"2025-04-23T13:54:51.643Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-48059","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","status":"published","published":"2022-12-10T00:00:00Z","modified":"2025-04-23T13:54:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:14.077439Z"}],"ghsa":[{"id":"GHSA-xvm4-qw2r-9jf6","title":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package...","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","status":"published","published":"2022-12-10T18:30:22Z","modified":"2025-04-23T15:31:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:02:00.180386Z"}],"nvd":[{"id":"CVE-2022-45145","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","status":"published","published":"2022-12-10T16:15:09.48Z","modified":"2026-06-17T05:09:27.747Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"ALPINE-CVE-2022-45145","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","status":"published","published":"2022-12-10T16:15:09.48Z","modified":"2026-11-03T07:30:52.986816688Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"UBUNTU-CVE-2022-45145","description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","status":"published","published":"2022-12-10T16:15:00Z","modified":"2026-10-17T12:56:22.886317161Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"}]}}