radare2 Command Injection via DWARF Parameter Names
Nobody has claimed this yet.
- Dominant language
- Nix
- Stars
- 26.2k
- Forks
- 20.1k
- PR merge metrics
- PR metrics pending
Description
- CVE-2026-40527
- Nixpkgs security tracker issue
- affected package maintainers: cc @arkivm, @Mic92, @makefu, @7c6f434c, @azahi
Description
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
References
- https://github.com/radareorg/radare2/pull/25821 (
issue-tracking) - https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 (
patch)
7.8 HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS version: 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
Affected packages
radare2(6.1.2@nixos-25.11, 6.1.2@nixos-unstable)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading radareorg/radare2 pull request 25821 and commit bc5a890, then inspect how the affected radare2 package is defined in nixpkgs. Compare the packaged version with the fixed upstream commit and verify that the affected versions are no longer selected. Done means the Nixpkgs package no longer ships the vulnerable radare2 version.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100