CVE-2026-129124

Name	CVE-2026-129124
Description	C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ckermit (PTS)	bookworm	402~beta08-1	vulnerable
	trixie	416~beta12-1+deb13u1	vulnerable
	forky	1:11.1.515-2	fixed
	sid	1:11.1.517-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ckermit	source	(unstable)	1:11.1.515-1

Notes

[trixie] - ckermit <no-dsa> (Minor issue)
https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p
Fixed by: https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57 (v11.1.515)