Executive brief
Sakura Editor is a text editor that provides features to open terminals and run system commands. When using the "Open PowerShell" feature, attackers can craft a directory name containing special characters that gets executed as a system command, potentially allowing arbitrary code execution on the victim's computer. Exploitation requires the victim to open a file in a maliciously-named directory.
Technical details
Sakura Editor contains an OS command injection vulnerability (CWE-78) in the "Open PowerShell" and "Open PowerShell as Administrator" features. The vulnerability arises when the directory path of an open text file is used to construct a system command without proper sanitization of special shell characters. An attacker can craft a directory name with shell metacharacters (e.g., semicolons, pipes, or command separators) that gets injected into the PowerShell command. Exploitation requires local access and user interaction—the victim must open a file in the malicious directory and invoke the "Open PowerShell" feature. A successful exploit grants the attacker the same privilege level as the user running Sakura Editor. The vulnerability was patched in version 2.4.3 released on August 8, 2026.
Affected products
- Sakura Editor Development Community Sakura Editor 2.4.2 and earlier
Timeline
- 2026-08-08: disclosed
- 2026-08-08: patched: Fixed in version 2.4.3