Fluxbox OS command injection via style background values

Fluxbox desktop manager: a bad theme file can let attackers run harmful commands on your PC.

Summary

The Fluxbox window manager does not escape style background values, allowing command injection. A crafted style file can make attackers run commands; versions up to and including 1.3.7 are affected.

Affected when

a crafted style file is loaded

What to do

Check that you run a version newer than 1.3.7, and read the vendor's advisory. No fixed version number is named in the sources.

Products and platforms

Linux
fluxbox

CVE IDs

CVE-2026-123784 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-06 15:01 UTC

First seen 2026-11-09 18:10 UTC