CVE Request: Textual IRC Client <= 5.2.7 Remote Command Execution

[Shubham Shah <sshah () bishopfox com>]

Hi,

We would like to request a CVE for a remote command execution vulnerability in the Textual IRC client <= 5.2.7 for OS 
X. 

An attacker is able to send messages to users of the Textual IRC Client 5.2.7 and below in order to inject arbitrary 
JavaScript within Textual’s web view upon limited user interaction. Unspecified attack vectors could allow for an 
attacker to achieve remote command execution on a victim’s machine, through the Textual IRC client.

The vendor has released a fix as seen in the following GitHub commit:

https://github.com/Codeux-Software/Textual/commit/422a6c8f7e750df506adaebb2db4bfa23f6aaa37

A patch has been released by the vendor and this security vulnerability has been fixed in Textual 5.2.8 as seen in the 
release notes:

https://www.codeux.com/textual/help/Release-Notes%3A-Version-5.2.8.kb

The release notes will be updated to include any CVE’s assigned for this remote command execution vulnerability.

This vulnerability was found by Shubham Shah and Joe DeMesy of Bishop Fox.

Thanks,

Shubham Shah
Senior SECURITY ANALYST

Email: sshah () bishopfox com
Phone: +61 0412 609 761
Fax: (480) 383-6401

WWW.BISHOPFOX.COM

Attachment: smime.p7s
Description: