CVE-2026-105841: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Uwe Ohse lrzsz

The vulnerability in lrzsz before 0.13.0 arises because the procheader() function in src/lrz.c passes unescaped ZMODEM/YMODEM filenames to popen() when lrz is run under a suffixed name such as lrztar. This improper neutralization of special elements in OS commands enables remote senders to execute arbitrary commands with the privileges of the receiving user by crafting malicious filenames. The CVSS 4.0 score is 7.7, indicating a high severity vulnerability with network attack vector, low attack complexity, partial attack and user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker who can send files to the vulnerable lrzsz utility in pipe mode can execute arbitrary OS commands on the target system with the privileges of the receiving user. This can lead to compromise of system confidentiality, integrity, and availability. The vulnerability requires the attacker to supply crafted filenames and some user interaction, but no privileges or special conditions are needed to initiate the attack.

No explicit patch or remediation is provided in the available data. Since the vulnerability affects versions before 0.13.0, upgrading to version 0.13.0 or later is implied as a remediation step. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.