lrzsz before version 0.13.0 contains an OS command injection bug that allows an attacker to execute arbitrary commands when the lrz receive utility runs in pipe mode. The flaw originates from the procheader() function in src/lrz.c, which forwards an unescaped ZMODEM/YMODEM filename to popen(). By supplying a filename that contains shell metacharacters, the attacker forces the shell to interpret those characters, executing the payload as the user running lrz, thereby enabling full compromise of the target system.

Affected by the lrzsz project, the vulnerability impacts all installations of the lrzsz utility distributed by Uwe Ohse that are older than version 0.13.0. The distribution includes the lrztar executable and other suffixed binaries that invoke lrz with pipe mode. No specific sub‑versions are identified beyond the general “prior to 0.13.0” designation.

With a CVSS base score of 7.7, this defect is considered high severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating a lower likelihood of active exploitation at present. An attacker can target the flaw remotely by initiating a ZMODEM or YMODEM session from which lrz receives data in pipe mode, and by crafting a malicious filename. The attack requires the receiver to run lrz with pipe mode, so the vector is likely remote network access to the receiving host or local use of the utility.