{"action":"Upgrade tracexec to 0.14.0 or later.","affected":[{"fixed":"0.14.0","introduced":"0"}],"component":"tracexec","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.14.0"],"ghsa_id":"GHSA-6fgx-x7m2-74qm","id":"tcs_01M5KETN5A0MQGEJ0ZNBZNDW0S","modified_at":"2025-10-13T20:19:36Z","published_at":"2025-10-13T20:19:36Z","references":["https://osv.dev/vulnerability/GHSA-6fgx-x7m2-74qm","https://github.com/kxxt/tracexec/security/advisories/GHSA-6fgx-x7m2-74qm","https://github.com/kxxt/tracexec/pull/118","https://github.com/kxxt/tracexec/commit/0dbe63214c8686df5bb62dbe6142cce27868ecff","https://github.com/kxxt/tracexec"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-6fgx-x7m2-74qm","url":"https://osv.dev/vulnerability/GHSA-6fgx-x7m2-74qm"}],"summary":"tracexec has `env` command argument injection via environment variables starting with dash in traced exec events"}