An unintended execution path exists in CrossWire Xiphos versions up to 4.3.2 that allows a local user to run arbitrary commands by passing specially crafted URLs or menu items. The flaw is caused by insufficient validation of user supplied data in the src/main/url.cc and src/gtk/menu_popup.c modules, which is a form of Command Injection (CWE-78). If successfully exploited the attacker takes full advantage of the privileges granted to the Xiphos process, potentially modifying data or escalating control over the host.

All installations of CrossWire Xiphos 4.3.2 and earlier are affected. The product name is CrossWire Xiphos and no vendor partner details are listed in this advisory.

The attack vector requires local access to the machine running Xiphos and is not detectable from the network. The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV. However, because the CVSS score of 7.8 represents high severity, the risk remains significant for environments where Xiphos runs with user‑level or elevated permissions. The vulnerability could be leveraged to compromise data integrity or availability on the local system.