CVE-2008-5986

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-28 · updated 2026-06-16

Description

Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).

Affected products

Csound: 5.08.2

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359
http://www.openwall.com/lists/oss-security/2009/01/26/2
http://www.securityfocus.com/bid/33446
https://bugzilla.redhat.com/show_bug.cgi?id=481550
https://exchange.xforce.ibmcloud.com/vulnerabilities/48276
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359
http://www.openwall.com/lists/oss-security/2009/01/26/2
http://www.securityfocus.com/bid/33446
https://bugzilla.redhat.com/show_bug.cgi?id=481550
https://exchange.xforce.ibmcloud.com/vulnerabilities/48276

Get alerted when CVE-2008-5986 or the next vulnerability affects your stack