CVE-2026-105841

Summary

The lrzsz library contains an OS command injection vulnerability in its receive utility that allows remote attackers to execute arbitrary commands as the receiving user when processing crafted filenames in pipe mode. This affects systems using lrz with suffixed names like lrztar.

Exploitability

Exploitation requires a remote attacker to send a specially crafted filename containing shell metacharacters to a vulnerable lrz receiver, which is moderately difficult due to the need for specific conditions including the use of suffixed binaries and pipe mode.

Blast radius

The vulnerability could impact any system running lrz in pipe mode with suffixed binaries, potentially allowing attackers to execute commands as the receiving user with high privileges, affecting servers or systems that process file transfers from untrusted sources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to lrzsz 0.13.0 or later to fix the OS command injection vulnerability in the lrz receive utility's pipe mode.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.