Description
The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | weechat | 0.3.9.2-1 | — |
| Debian 13 | weechat | 0.3.9.2-1 | — |
| Debian 12 | weechat | 0.3.9.2-1 | — |
| Debian 6.0 | weechat | 0.3.2-1+squeeze1 | DSA-2598-1 |
Advisories 1
- DSA-2598-1 weechat - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commitdiff_plain%3Bh=efb795c74fe954b9544074aafcebb1be4452b03a
- 51294 third-party-advisory
- 51377 third-party-advisory
- openSUSE-SU-2013:0150 vendor-advisory
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0347
- openSUSE-SU-2012:1580 vendor-advisory
- 56584 vdb-entry
- FEDORA-2012-18575 vendor-advisory
- http://weechat.org/security/
- FEDORA-2012-18526 vendor-advisory
- [oss-security] 20121119 Re: Fwd: [[Weechat-security] Security vulnerability in WeeChat 0.3.0 -> 0.3.9.1] mailing-list
- https://savannah.nongnu.org/bugs/?37764
- MDVSA-2013:136 vendor-advisory
- FEDORA-2012-18494 vendor-advisory