CVE-2023-39726 Code injection in n/a

What is CVE-2023-39726?

CVE-2023-39726 is a critical code injection vulnerability in n/a, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.

Weakness: CWE-96

Which versions are affected by CVE-2023-39726?

It affects 1 product.

Products include Mintty Project Mintty.

How do I fix CVE-2023-39726?

No fix has been published for CVE-2023-39726 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-39726 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39726 exists.

Other vulnerabilities in n/a

• CVE-2022-47583 Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal. Critical 9.8
• CVE-2025-1052 Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2021-31701 Other in n/a High 7.5
• CVE-2021-28848 Denial of service in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r6j8-w974-w846.