CVE-2023-39726

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-96

Affected software

No affected versions have been published.

Timeline

Published
Oct 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-39736.1Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.CVE-2023-397315.3The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast meCVE-2023-397328.2The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broaCVE-2023-397338.2The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast mCVE-2023-397348.2The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token anCVE-2023-397358.2The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadCVE-2023-397368.2The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted brCVE-2023-397378.2The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messaCVE-2023-397398.2The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted brCVE-2023-39749.8OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.CVE-2023-397408.2The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadCVE-2023-397415.5lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vul
CVE-2023-39726: Critical severity, CVSS 9.8 | Vulnix