{"id":"CVE-2023-1350","aliases":["DEBIAN-CVE-2023-1350","EUVD-2023-23608","GHSA-9q9p-r5vc-g557","MGASA-2023-0103","UBUNTU-CVE-2023-1350","openSUSE-SU-2023:0096-1","openSUSE-SU-2024:12783-1"],"status":"published","title":"liferea Feed Enrichment update.c update_job_run os command injection","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02298,"percentile":0.8341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2023-03-11T08:20:34Z","modified":"2026-10-28T10:36:12Z","fixes":[{"ecosystem":"Debian:12","package":"liferea","fixed_in":["1.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"liferea","fixed_in":["1.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"liferea","fixed_in":["1.14.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"liferea","fixed_in":["1.12.10-1.1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"liferea","fixed_in":["1.14.1-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"liferea","fixed_in":["1.14.1-bp154.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.10-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.12-1ubuntu1","1.10.17-1ubuntu1","1.10.17-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12~rc3-1ubuntu2","1.12.0-2ubuntu1","1.12.1-1~build1","1.12.1-1","1.12.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.6-1","1.12.7-1","1.12.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.5-3","1.13.6-2","1.13.7-1","1.13.7-2","1.13.7-2build1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"liferea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-bp154.2.3.1"}]}]}],"products":[{"vendor":"liferea_project","product":"liferea"}],"references":[{"url":"https://vuldb.com/?id.222848","tags":["vdb-entry","technical-description","x_transferred","VDB Entry","advisory"]},{"url":"https://vuldb.com/?ctiid.222848","tags":["signature","permissions-required","x_transferred","Permissions Required","VDB Entry","report"]},{"url":"https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59","tags":["patch","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1350","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9q9p-r5vc-g557"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1350.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-1350","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0103.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31664","tags":["report"]},{"url":"https://github.com/lwindolf/liferea/releases/tag/v1.12.10","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-1350","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1350","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U2XWO532L7BXCMKLBA5M4DP7HIU4NSO2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193579","tags":["report"]},{"url":"https://bugzilla.suse.com/1209190","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1350","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-1350","title":"liferea Feed Enrichment update.c update_job_run os command injection","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T08:20:34.058Z","modified":"2024-08-02T05:41:00.255Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-23608","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T08:20:34Z","modified":"2024-08-02T05:41:00Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:15.560413Z"}],"ghsa":[{"id":"GHSA-9q9p-r5vc-g557","title":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is...","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T09:30:14Z","modified":"2023-03-23T05:04:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:54:23.065737Z"}],"nvd":[{"id":"CVE-2023-1350","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T09:15:10.197Z","modified":"2026-06-17T05:27:44.88Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-1350","title":"liferea Feed Enrichment update.c update_job_run os command injection","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T08:20:34.058Z","modified":"2026-10-28T10:36:12.914351045Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"DEBIAN-CVE-2023-1350","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T09:15:10.197Z","modified":"2026-10-26T18:00:21.432992017Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-1350","description":"A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date \u0026gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.","status":"published","published":"2023-03-11T09:15:00Z","modified":"2025-10-24T05:01:09Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"MGASA-2023-0103","title":"Updated liferea packages fix security vulnerability","description":"Remote code execution on feed enrichment. If \"Extract full content from\nHTML5 and Google AMP\" has been enabled for one or more feed subscriptions\nit is possible for a an attacker to inject a script command that runs\nwith user priveleges. (CVE-2023-1350)\n","status":"published","published":"2023-03-18T22:16:28Z","modified":"2026-04-16T04:41:51.491678366Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0096-1","title":"Security update for liferea","description":"\nliferea was updated to version 1.14.1:\n\n+ Fix CVE-2023-1350 - Remote code execution on feed enrichment (boo#1209190).\n\nUpdate to version 1.14.0:\n\n+ New 'Reader mode' preference that allows stripping all web\n  content\n+ Implement support for Webkits Intelligent Tracking Protection\n+ New progress bar when loading websites\n+ Youtube videos from media:video can be embedded now with a\n  click on the video preview picture.\n+ Changes to UserAgent handling: same UA is now used for both\n  feed fetching and internal browsing.\n+ New view mode 'Automatic' which switches between 'Normal' and\n  'Wide' mode based on the window proportions.\n+ Liferea now supports the new GTK dark theme logic, where in\n  the GTK/GNOME preferences you define wether you 'prefer' dark\n  mode or light mode\n+ Favicon discovery improvements: now detects all types of Apple\n  Touch Icons, MS Tile Images and Safari Mask Icons\n+ Increase size of stored favicons to 128x128px to improve icon\n  quality in 3-pane wide view.\n+ Make several plugins support gettext\n+ Allow mutiple feed in same libnotify notification\n+ Redesign of the update message in the status bar. It now shows\n  a update counter of the feeds being in update.\n+ You can now export a feed to XML file\n+ Added an option to show news bins in reduced feed list\n+ Added menu option to send item per mail\n+ Default to https:// instead of http:// when user doesn't\n  provide protocol on subscribing feed\n+ Implement support for subscribing to LD+Json metadata listings\n  e.g. concert or theater event listings\n+ Implement support for subscribing to HTML5 websites\n+ Support for media:description field of Youtube feeds\n+ Improve HTML5 extraction: extract main tag if it exists and\n  no article was found.\n+ Execute feed pipe/filter commands asynchronously\n+ Better explanation of feed update errors.\n+ Added generic Google Reader API support (allows using FeedHQ,\n  FreshRSS, Miniflux...)\n+ Now allow converting TinyTinyRSS subscriptions to\n  local subscriptions\n+ New search folder rule to match podcasts\n+ New search folder rule to match headline authors\n+ New search folder rule to match subscription source\n+ New search folder rule to match parent folder name\n+ New search folder property that allows hiding read items\n+ Now search folders are automatically rebuild when rules are\n  changed\n+ Added new plugin 'add-bookmark-site' that allows to configure\n  a custom bookmarking site.\n+ Added new plugin 'getfocus' that adds transparency on the feed\n  list when it is not focussed.\n+ Trayicon plugin has now a configuration option to change the\n  behaviour when closing Liferea.\n+ Trayicon plugin has now an option to disable minimizing to tray\n+ New hot key Ctrl-D for 'Open in External Browser'\n+ New hot key F10 for headerbar plugin to allow triggering the\n  hamburger menu\n+ New hot key Ctrl-0 to reset zoom\n+ New hot key Ctrl-O to open enclosures\n+ Fix hidden panes, Liferea will never allow the panes to be\n  smaller than 5% in height or width\n+ Wait for network to be fully available before updating\n+ 2-pane mode was removed\n+ Dropped CDF channel support\n+ Dropped Atom 0.2/0.3 (aka Pie) support\n+ Dropped blogChannel namespace support\n+ Dropped photo namespace support\n\n- Require python3-cairo; needed for tray icon (boo#1193579).\n","status":"published","published":"2023-04-27T12:51:25Z","modified":"2026-02-04T03:34:26.957722Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12783-1","title":"liferea-1.14.1-1.1 on GA media","description":"These are all security issues fixed in the liferea-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:27.094126Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}