Greenshot vulnerabilities

Greenshot versions 1.3.310 and below are vulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.

Greenshot version 1.2.10 and below allows arbitrary code execution due to insecure deserialization of .NET content when a .greenshot file is opened.

Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The authorization check for the channel occurs only after deserialization, so any gadget chain in the serialized payload executes regardless of channel membership. This is fixed in version 1.3.301.