Description
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | newsbeuter | 2.9-5+deb9u1 | DSA-3947-1 |
| Debian 8 | newsbeuter | 2.8-2+deb8u1 | DSA-3947-1 |
| Debian 7 | newsbeuter | 2.5-2+deb7u2 | DLA-1061-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | newsbeuter | 2.9-3ubuntu0.1 | USN-4585-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.7 | newsbeuter | 2.9-r4 | — |
| Alpine v3.6 | newsbeuter | 2.9-r4 | — |
| Alpine v3.5 | newsbeuter | 2.9-r4 | — |
| Alpine v3.4 | newsbeuter | 2.9-r4 | — |
| Alpine v3.3 | newsbeuter | 2.9-r4 | — |
Advisories 3
- DSA-3947-1 newsbeuter - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1061-1 newsbeuter - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4585-1 newsbeuter vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026