CVE-2026-105841

Name	CVE-2026-105841
Description	lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150240

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lrzsz (PTS)	bookworm	0.12.21-10	vulnerable
	trixie	0.12.21rc-0.2	vulnerable
	forky, sid	0.13.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
lrzsz	source	(unstable)	0.13.1-1			1150240

Notes

[trixie] - lrzsz <no-dsa> (Minor issue)
https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html
Fixed by: https://github.com/UweOhse/lrzsz/commit/9eef71ce20fda2b345ef8431359aec96121215bd (release_0.13.0)