CVE Catalog
CVE-2024-32487
MediumSummary
In less through version 653, improper quoting in filename.c allows OS command execution via a newline character in a file name. Exploitation typically requires attacker-controlled file names, such as from untrusted archives.
Risk Assessment
The risk includes remote code execution by an attacker, potentially leading to full system compromise.
Recommendation
It is recommended to upgrade less to a version newer than 653 that includes a fix for this issue.
Original NVD description (English source)
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESS