Technical impact
The vulnerability is a command injection flaw in radare2 triggered when an attacker supplies a specially crafted PDB name to the rabin2 -PP command while the software runs on UNIX systems with SSL disabled. Affected releases are those before commit 9236f44, specifically those released between version 6.1.2 and 6.1.3. If an attacker can control the PDB name, the shell is executed with arbitrary commands, potentially granting full control of the host where radare2 is running. This flaw is classified as CWE‑78.
Affected Systems
Users of radare2 before commit 9236f44 that are configured on UNIX without SSL are affected. This includes all versions released between 6.1.2 and 6.1.3; it is inferred that earlier releases that have not applied the patch may also be affected. Releases after 6.1.3 or those with SSL enabled are not impacted.
Risk and Exploitability
The vulnerability has a CVSS score of 7.4, indicating high severity. Exploitation requires the ability to influence the PDB name in the rabin2 -PP invocation. If radare2 is run by a privileged user or if it is exposed through a network service without SSL—a scenario inferred from the description—an attacker could achieve remote code execution. EPSS score is 1% and the issue is not listed in the CISA KEV catalog at this time.
