CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
Remote attackers can execute arbitrary commands on the receiving system by sending crafted filenames via the lrz pipe mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-105841?
CVE-2026-105841 is a high-severity command injection vulnerability in Uwe Ohse lrzsz, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
Weakness: CWE-78
Which versions are affected by CVE-2026-105841?
How do I fix CVE-2026-105841?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-105841 being exploited?
There is no known exploitation of CVE-2026-105841 in the wild and no public exploit code.
Sources
Also known as AZL-106673, DEBIAN-CVE-2026-105841, GHSA-w9c3-4vq7-c452, UBUNTU-CVE-2026-105841.