{"action":"Upgrade kvirc to 2:3.2.4-5 or later.","affected":[{"fixed":"2:3.2.4-5","introduced":"0"}],"component":"kvirc","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2:3.2.4-5"],"id":"tcs_01M5N8T4WK9E7D502DYP6A9DC2","modified_at":"2026-10-21T17:47:48.691957751Z","published_at":"2007-06-26T18:30:00Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2007-2951","https://security-tracker.debian.org/tracker/CVE-2007-2951"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2007-2951#Debian:13/kvirc","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2007-2951"}],"summary":"The parseIrcUrl function in src/kvirc/kernel/kvi_ircurl.cpp in KVIrc 3.2.0 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an (1) irc:// or (2) irc6://"}