CVE-2023-43115 Command injection in n/a

What is CVE-2023-43115?

CVE-2023-43115 is a high-severity command injection vulnerability in Artifex Ghostscript, published on 18 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).

Which versions are affected by CVE-2023-43115?

It affects 2 products.

Products include Artifex Ghostscript, Fedoraproject Fedora.

How do I fix CVE-2023-43115?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-43115 being exploited?

There is no known exploitation of CVE-2023-43115 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Artifex Ghostscript

• CVE-2017-8291 Artifex Ghostscript Type Confusion Exploited High 7.8
• CVE-2021-3781 Command injection in ghostscript Critical 9.9
• CVE-2025-27831 Memory corruption in n/a Critical 9.8
• CVE-2025-27832 Memory corruption in n/a Critical 9.8
• CVE-2025-27836 Memory corruption in n/a Critical 9.8

All Artifex Ghostscript vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-43115, ALSA-2023:6265, ALSA-2023:6732, BELL-CVE-2023-43115, DEBIAN-CVE-2023-43115, GHSA-9p55-888j-qxrh and 12 more.