CrossWire Xiphos CVE-2026-79079

Requires local access to a system running CrossWire Xiphos <= 4.3.2 (GTK desktop app on Linux/Unix). Exploitation is reached through two specific features: the personal-commentary 'rename' action (on_rename_perscomm_activate in src/gtk/menu_popup.c), where the module section name info->text1 is interpolated into a cd/sed shell pipeline, and the separate-image viewer (show_separate_image in src/main/url.cc), where an image filename is interpolated into the external display program's command line - both passed to popen() unsanitized. Realistic exploitation depends on a victim performing one of these actions on attacker-supplied data (a crafted module or image whose name embeds shell metacharacters); code runs only with that user's privileges (no privilege escalation), which along with the local vector and niche product footprint limits practical risk.

Signals converge on a genuine-but-low-urgency local RCE. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) correctly captures a local, low-complexity command-injection with full CIA impact, and the source diff confirms the root cause: two sinks (menu_popup.c on_rename_perscomm_activate and url.cc show_separate_image) build shell command strings via g_string_printf and pass them to popen(), embedding attacker-influenced values (the personal-commentary module section name info->text1 and an image filename) directly into a shell context. SSVC agrees - Exploitation:poc, Automatable:no, Technical Impact:total - matching a POC that exists (public gist) but requires local, non-automatable, user-driven triggering. EPSS is 0.15% (5th percentile) and there is NO CISA KEV listing, consistent with a niche desktop application unlikely to see mass exploitation. Net: a real, patch-worthy code-execution bug, but a low real-world priority driven by the local attack vector, niche footprint, and lack of active-exploitation evidence rather than a widespread threat. Note a defensible disagreement with UI:N - realistic exploitation depends on a victim performing an action (renaming a module or viewing an image) on attacker-supplied data, so UI:R is arguable; this does not change the base severity band materially.

An attacker distributes a malicious Xiphos personal-commentary module (or image resource) whose section name or filename contains shell metacharacters such as $(...) or backticks. When the local user renames that module or opens the separate-image viewer, Xiphos assembles a shell string and calls popen(), executing the attacker's injected command with the victim's privileges. A public proof-of-concept gist exists, but exploitation requires local access and a victim action, so it is not remotely or automatically weaponizable.