CVE-2022-45145

Description

egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.

Affected Platforms

Weakness Type

CWE-78, CWE-78

References

• https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=…
• https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=…
• https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html
• https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=…
• https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=…
• https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html