HSEC-2023-0003

See a problem?
Import Source
https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0003.json
JSON Data
https://api.osv.dev/v1/vulns/HSEC-2023-0003
Aliases
Published
2025-11-14T14:45:34Z
Modified
2025-11-14T18:15:33.129091Z
Summary
code injection in xmonad-contrib
Details

code injection in xmonad-contrib

The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.

Database specific 
{
    "repository": "https://github.com/haskell/security-advisories",
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export"
}
References

Affected packages

Hackage / xmonad-contrib

Package

Name
xmonad-contrib
Purl
pkg:hackage/xmonad-contrib

Severity

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.5
Fixed
0.11.2

Affected versions

0.*

0.5
0.6
0.7
0.8
0.8.1
0.9
0.9.1
0.9.2
0.10
0.11
0.11.1

Database specific

source

"https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0003.json"

osv

"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0003.json"

human_link

"https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0003.md"