CVE-2022-45145

egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2022-12-10

Last modified

2025-04-23

Weaknesses

CWE-78

Affected products

• Chicken (Call-cc)

References

• https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=NEWS%3Bh=54888afff09353093453673c407cab…
• https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=egg-compile.scm%3Bh=9ba4568113350ec7520…
• https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html