Fluxbox through version 1.3.7 allows an attacker to inject arbitrary OS commands by embedding shell metacharacters inside style background values. The RootTheme::reconfigTheme() function concatenates unescaped background pixmap paths, directory names, or gradient texture strings into an "fbsetbg" command and executes it via $SHELL -c. Because this command runs with the privileges of the Fluxbox process, the injected code executes with user rights, enabling arbitrary command execution on the host.

The vulnerability affects the Fluxbox window manager distributed by the Fluxbox project, specifically all releases up to and including 1.3.7. It resides in the RootTheme component that processes style configuration files. No other vendors or products are listed.

The CVSS score of 8.5 classifies this flaw as high severity, indicating a significant threat to confidentiality, integrity, and availability if successfully exploited. The EPSS score is not available, so exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation. The command runs under the user account that launches Fluxbox, which means the attacker must gain local influence over style configuration or coerce a user to load malicious style data. While the attack vector appears local, a local user could elevate to privileged commands, presenting a serious risk.