CVE-2026-33145
Remote Code Execution in xrdp via AlternateShell Parameter
Publication date: 2026-04-17
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| neutrinolabs | xrdp | to 0.10.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in xrdp, an open source RDP server, in versions through 0.10.5. It allows an authenticated remote user to execute arbitrary commands on the server because of unsafe handling of the AlternateShell parameter in xrdp-sesman.
When the AllowAlternateShell setting is enabled (which is the default if not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This means that unsanitized, user-controlled input is executed as a shell command.
This behavior provides a scriptable remote command execution capability over RDP within the security context of the authenticated user, occurring before the normal window manager starts. It can bypass expected session initialization flows and assumptions that restrict execution to interactive desktop environments.
The issue was fixed in version 0.10.6.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated remote user to execute arbitrary commands on the affected server with the privileges of the authenticated user.
Because the commands are executed before the normal desktop environment starts, it can bypass security controls or operational assumptions that expect execution only within an interactive desktop session.
This could lead to unauthorized actions such as data manipulation, privilege escalation (depending on user privileges), or disruption of normal server operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade xrdp to version 0.10.6 or later where the issue has been fixed.
Alternatively, disable the AllowAlternateShell setting in the xrdp configuration to prevent execution of client-supplied AlternateShell commands.