CVE-2025-52365
Command Injection in ccurtsinger/stabilizer szc Script Enables RCE
Publication date: 2026-03-03
Last updated on: 2026-03-03
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ccurtsinger | stabilizer | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2025-52365 is a command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository. The vulnerability occurs because the script uses Python's os.system() function to execute shell commands that are constructed by directly concatenating user-supplied input without proper sanitization or validation."}, {'type': 'paragraph', 'content': 'Specifically, command-line arguments such as output file names are embedded directly into shell command strings. This allows an attacker to inject arbitrary shell commands by including shell metacharacters in the input, leading to remote code execution on the host system.'}, {'type': 'paragraph', 'content': 'For example, an attacker could run the script with an argument like `-o "out; touch /tmp/pwned"` which would cause the system to execute the injected command and create a file `/tmp/pwned`, demonstrating the command injection.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows attackers to execute arbitrary system commands on the host running the szc script, which can lead to full compromise of the system.
- Local impact: A user could be tricked into running szc on a malicious file, resulting in execution of attacker-controlled commands.
- CI/CD pipelines: Automated build processes that run szc on untrusted inputs (such as pull requests) can be compromised, allowing attackers to execute malicious commands during builds.
- Network exposure: If szc is exposed via a web API or other network interface, remote unauthenticated attackers could gain shell access to the system.
Overall, the vulnerability can lead to unauthorized access, data compromise, system manipulation, and potentially full system takeover.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for the presence and usage of the vulnerable szc script from the ccurtsinger/stabilizer repository, especially if it is run with unsanitized user inputs that are passed to os.system().'}, {'type': 'paragraph', 'content': 'A practical detection method is to attempt a proof-of-concept command injection by running the szc script with crafted input that includes shell metacharacters. For example, running the command:'}, {'type': 'list_item', 'content': './szc -o out "test.c; touch /tmp/pwned"'}, {'type': 'paragraph', 'content': 'If the file /tmp/pwned is created, it confirms the presence of the command injection vulnerability.'}, {'type': 'paragraph', 'content': 'Additionally, monitoring your system for unexpected file creations or command executions triggered by szc, or scanning logs for suspicious command patterns involving szc, can help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include sanitizing all user inputs passed to the szc script to remove shell metacharacters that could be used for command injection.'}, {'type': 'paragraph', 'content': 'A more secure approach is to replace the use of os.system() with the subprocess module using argument lists, which avoids shell interpretation and prevents injection. For example:'}, {'type': 'list_item', 'content': 'import subprocess'}, {'type': 'list_item', 'content': 'subprocess.run(["gcc", args.o + ".s"])'}, {'type': 'paragraph', 'content': 'Until a patched version is available, avoid running szc on untrusted inputs, especially in automated CI/CD pipelines or exposed web APIs.'}] [1]