CoreCVE
Back

HIGH

xterm.js: Mishandling of special characters allows for remote code execution

Published Jan 9, 2019

Description

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Affected products

Remediation

Red Hat statement

This issue affects both the atomic-openshift-web-console RPM and openshift3/ose-console container image shipped in OpenShift Container Platform. These components provide a web console for opening in-browser terminals in cluster pods. Successful exploitation of this issue would require an attacker to convince an authorized user to open an in-browser terminal on a target pod and execute a command that prints attacker-controlled input. Red Hat Product Security have rated this issue as having security impact of Moderate. A future update may address this issue.

Weaknesses (2)

CWE-77

CWE-94

Code Injection

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner microsoft
Published Jan 9, 2019
Updated Aug 4, 2024
Reserved Nov 26, 2018
Link CVE-2019-0542
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-0542
Red Hat
Severity Moderate
Public date Jan 9, 2019
Links CVE-2019-0542 - Bugzilla
GHSA-MC23-976P-J42X