Read the docs
TI-2012-01858 Aliases CVE-2012-2085GHSA-m3cr-88v9-chgp

The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted…

Priority LOW 36CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.

Why it matters now

EPSS 0.03179 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:gajim:gajim:*:*:*:*:*:*:*:*up to 0.14.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.1:*:*:*:*:*:*:*0.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.10:*:*:*:*:*:*:*0.10VulnerableGajim
cpe:2.3:a:gajim:gajim:0.10.1:*:*:*:*:*:*:*0.10.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11:*:*:*:*:*:*:*0.11VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.1:*:*:*:*:*:*:*0.11.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.2:*:*:*:*:*:*:*0.11.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.3:*:*:*:*:*:*:*0.11.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.11.4:*:*:*:*:*:*:*0.11.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12:*:*:*:*:*:*:*0.12VulnerableGajim
  • cpe:2.3:a:gajim:gajim:*:*:*:*:*:*:*:* Versions up to 0.14.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.10.1:*:*:*:*:*:*:* Versions 0.10.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.1:*:*:*:*:*:*:* Versions 0.11.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.2:*:*:*:*:*:*:* Versions 0.11.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.3:*:*:*:*:*:*:* Versions 0.11.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.11.4:*:*:*:*:*:*:* Versions 0.11.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12:*:*:*:*:*:*:* Versions 0.12 Vulnerable ·Gajim
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gajim:gajim:0.12.1:*:*:*:*:*:*:*0.12.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.2:*:*:*:*:*:*:*0.12.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.3:*:*:*:*:*:*:*0.12.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.4:*:*:*:*:*:*:*0.12.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.5:*:*:*:*:*:*:*0.12.5VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.5:alpha1:*:*:*:*:*:*0.12.5 alpha1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.12.5:beta1:*:*:*:*:*:*0.12.5 beta1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13:*:*:*:*:*:*:*0.13VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.1:*:*:*:*:*:*:*0.13.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.2:*:*:*:*:*:*:*0.13.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.3:*:*:*:*:*:*:*0.13.3VulnerableGajim
cpe:2.3:a:gajim:gajim:0.13.4:*:*:*:*:*:*:*0.13.4VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14:*:*:*:*:*:*:*0.14VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.1:*:*:*:*:*:*:*0.14.1VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.2:*:*:*:*:*:*:*0.14.2VulnerableGajim
cpe:2.3:a:gajim:gajim:0.14.3:*:*:*:*:*:*:*0.14.3VulnerableGajim
  • cpe:2.3:a:gajim:gajim:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.2:*:*:*:*:*:*:* Versions 0.12.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.3:*:*:*:*:*:*:* Versions 0.12.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.4:*:*:*:*:*:*:* Versions 0.12.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.5:*:*:*:*:*:*:* Versions 0.12.5 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.5:alpha1:*:*:*:*:*:* Versions 0.12.5 alpha1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.12.5:beta1:*:*:*:*:*:* Versions 0.12.5 beta1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13:*:*:*:*:*:*:* Versions 0.13 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.1:*:*:*:*:*:*:* Versions 0.13.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.2:*:*:*:*:*:*:* Versions 0.13.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.3:*:*:*:*:*:*:* Versions 0.13.3 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.13.4:*:*:*:*:*:*:* Versions 0.13.4 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14:*:*:*:*:*:*:* Versions 0.14 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.1:*:*:*:*:*:*:* Versions 0.14.1 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.2:*:*:*:*:*:*:* Versions 0.14.2 Vulnerable ·Gajim
  • cpe:2.3:a:gajim:gajim:0.14.3:*:*:*:*:*:*:* Versions 0.14.3 Vulnerable ·Gajim

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2085
  2. 2026-10-03 Alias added: GHSA-m3cr-88v9-chgp

References

Exploit 1

Advisory 1

Other 3

  • TI-2012-01859 SQL injection vulnerability in the get_last_conversation_lines function in… CVSS 2.0HIGH 7.5
  • TI-2021-17909 Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service… CVSS 3.1HIGH 7.5
  • TI-2022-18830 An issue was discovered in Gajim through 1.4.7. CVSS 3.1MEDIUM 5.3
  • TI-2015-07148 Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages… CVSS 3.0MEDIUM 5.4
  • TI-2016-08426 Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling… CVSS 3.0MEDIUM 4.5
  • TI-2012-04643 The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly… CVSS 2.0MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences