Executive brief
Xiphos is a Bible study application that includes a D-Bus interface for remote control. An attacker with access to the user's session bus can send a crafted image reference that injects shell commands into a filename, achieving arbitrary code execution with the user's privileges. This allows complete compromise of the Xiphos process and potentially the user's account.
Technical details
The vulnerability is an OS command injection (CWE-78) in the show_separate_image() function in src/main/url.cc, where attacker-controlled filenames are passed to popen() without proper sanitization. Although the filename is quoted, shell metacharacters like $() are still interpreted. The attack is triggered via the D-Bus setCurrentReference() method, which chains through ipc_object_set_current_reference() and main_url_handler() to reach the vulnerable code. A fix was released replacing popen() with g_spawn functions that bypass shell interpretation.
Affected products
- CrossWire Xiphos through 4.3.2
Timeline
- 2026-09-21: disclosed: CVE published
- 2026-05-22: patched: Fix merged in PR #1314 replacing popen with g_spawn functions