CVE-2024-53992 — unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen …
Published: 2024-12-02 · CVSS: 8.8 · CVSS 4.0
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7