CVE-2022-46387

ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and then execute it as commands.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.87% chance of exploitation in the next 30 days, 58th percentile

Published

2023-03-28

Updated

2025-02-19

Proof-of-concept exploits (1)

• dgl/houdini-kubectl-poc9★ · 2023-03-14

Security advisories

• https://gist.github.com/dgl/05ca60cdc7efc9e47bbc58d0c952635e
• cmderdev/cmder/blob/master/CHANGELOG.md

References

• CVE Record
• NVD entry

Related

• CVE-2021-25743
• CVE-2022-44702
• CVE-2022-45063
• CVE-2022-45872
• CVE-2025-61984