Skip to content
OpenAdvisories
High USN-4700-1 1 CVE

pyxdg vulnerability

Published Jan 19, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Alexandre D'Hondt discovered that PyXDG did not properly sanitize input.
An attacker could exploit this with a crafted .menu file to execute
arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS pyxdg 0.25-4ubuntu0.16.04.1
Ubuntu · 18.04 LTS 18.04:LTS pyxdg 0.25-4ubuntu1.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS pyxdg 0.25-4ubuntu0.14.04.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2019-12761

    Code Injection in PyXDG

    A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This i…

    pyxdg pyxdg pyxdg Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2019-12761