Search: CVE-2026-105841

CVE-2026-105841 is an OS command injection vulnerability in lrzsz before version 0.13.0. The flaw exists in the lrz receive utility's pipe mode when run under suffixed names like lrztar. It allows remote senders to execute arbitrary commands by supplying crafted filenames that are passed unescaped to popen(). This vulnerability has a high severity rating with a CVSS score of 7.7.