CVE-2026-107802
2026-10-08
23h17 +00:00
23h17 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Improper Neutralization of Argument Delimiters in a Command The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
