cve: CVE-2018-1000156
alias: GNU patch ed-mode arbitrary command exec
cwe_primary: CWE-78
cwe_acceptable: [CWE-78, CWE-77, CWE-88, CWE-74]
target_file: source.c
vuln_lines: [29, 30]
severity: high
vuln_class: command_injection
exploit_pattern_regex: '`|\$\(|;|&&|\|\|'
must_mention_any:
  - system()
  - shell metacharacter
  - command injection
  - snprintf
  - unsanitised
  - unsanitized
  - shell command
points: 25
notes: |
  Vulnerability: target_path_from_patch_header returns an unvalidated string
  copied from the patch header. apply_ed_patch then formats it directly into a
  shell command with snprintf and passes to system(). Attacker controls the
  patch file → controls `target` → injects backticks/$()/; → arbitrary command.