Read the docs
TI-2003-00066 Aliases CVE-2003-0070GHSA-mv26-jcw9-w5v8

VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in…

Priority LOW 34Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.

Why it matters now

EPSS 0.02078 81st percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:nalin_dahyabhai:vte:0.11.21:*:*:*:*:*:*:*0.11.21VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.12.2:*:*:*:*:*:*:*0.12.2VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.14.2:*:*:*:*:*:*:*0.14.2VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.15.0:*:*:*:*:*:*:*0.15.0VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.16.14:*:*:*:*:*:*:*0.16.14VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.17.4:*:*:*:*:*:*:*0.17.4VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.20.5:*:*:*:*:*:*:*0.20.5VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.22.5:*:*:*:*:*:*:*0.22.5VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.24.3:*:*:*:*:*:*:*0.24.3VulnerableNalin Dahyabhai
cpe:2.3:a:nalin_dahyabhai:vte:0.25.1:*:*:*:*:*:*:*0.25.1VulnerableNalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.11.21:*:*:*:*:*:*:* Versions 0.11.21 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.12.2:*:*:*:*:*:*:* Versions 0.12.2 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.14.2:*:*:*:*:*:*:* Versions 0.14.2 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.15.0:*:*:*:*:*:*:* Versions 0.15.0 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.16.14:*:*:*:*:*:*:* Versions 0.16.14 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.17.4:*:*:*:*:*:*:* Versions 0.17.4 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.20.5:*:*:*:*:*:*:* Versions 0.20.5 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.22.5:*:*:*:*:*:*:* Versions 0.22.5 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.24.3:*:*:*:*:*:*:* Versions 0.24.3 Vulnerable ·Nalin Dahyabhai
  • cpe:2.3:a:nalin_dahyabhai:vte:0.25.1:*:*:*:*:*:*:* Versions 0.25.1 Vulnerable ·Nalin Dahyabhai
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnome:gnome-terminal:2.0:*:*:*:*:*:*:*2.0VulnerableGNOME
cpe:2.3:a:gnome:gnome-terminal:2.2:*:*:*:*:*:*:*2.2VulnerableGNOME
  • cpe:2.3:a:gnome:gnome-terminal:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gnome-terminal:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·GNOME

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Linux 8.0Fixed RHSA-2003:053

Timeline

  1. 2026-10-02 Threatist record created from CVE-2003-0070
  2. 2026-10-03 Alias added: GHSA-mv26-jcw9-w5v8

References

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences