Urwid
Monthly
Session hijacking and keystroke injection in the urwid Python library's web display backend (urwid/display/web.py) let attackers take over active web terminal sessions and reach OS-level code execution with the session owner's privileges. The urwid_id session token is generated with Python's non-cryptographic Mersenne Twister PRNG, so a remote attacker who observes roughly 334 session IDs (e.g. via the X-Urwid-ID response header) can reconstruct PRNG state and predict every past and future token, while any local user can read the same token from world-listable FIFO filenames in /tmp. No public exploit has been identified at time of analysis; the issue was reported by VulnCheck and carries a 9.2 (CVSS 4.0) severity.
Session hijacking and keystroke injection in the urwid Python library's web display backend (urwid/display/web.py) let attackers take over active web terminal sessions and reach OS-level code execution with the session owner's privileges. The urwid_id session token is generated with Python's non-cryptographic Mersenne Twister PRNG, so a remote attacker who observes roughly 334 session IDs (e.g. via the X-Urwid-ID response header) can reconstruct PRNG state and predict every past and future token, while any local user can read the same token from world-listable FIFO filenames in /tmp. No public exploit has been identified at time of analysis; the issue was reported by VulnCheck and carries a 9.2 (CVSS 4.0) severity.