Critical · 9.8 CVE-2022-44542 EUVD-2022-47485GHSA-2m3w-662q-8c6m

lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution vi…

Published Nov 1, 2022 · Updated May 5, 2025 · Assigned by mitre

Description

lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution via a key/value pair in a hash.

References

https://bugs.gentoo.org/865631
https://github.com/wofr06/lesspipe/releases/tag/v2.06
GLSA-202211-02 vendor-advisory