CVE-2018-1000523

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-26 · updated 2026-06-17
Weakness: CWE-20

Description

topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including terminal escape code sequences. This attack appear to be exploitable via The victim must open a todo.txt with at least one specially crafted line..

Affected products

Topydo: all versions

References

https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292
https://github.com/bram85/topydo/issues/240
https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292
https://github.com/bram85/topydo/issues/240

Get alerted when CVE-2018-1000523 or the next vulnerability affects your stack