CVE-2019-12761

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.

• CWE-94

• https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916febaExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html
• https://lists.debian.org/debian-lts-announce/2021/08/msg00003.html
• https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562Third Party Advisory
• https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916febaExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html
• https://lists.debian.org/debian-lts-announce/2021/08/msg00003.html
• https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562Third Party Advisory

Published

Jun 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12756Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be…2.3
• CVE-2019-12757Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1…7.8
• CVE-2019-12758Symantec Endpoint Protection, prior to 14.2 RU2, may be susc…6.7
• CVE-2019-12759Symantec Endpoint Protection Manager (SEPM) and Symantec Mai…7.8
• CVE-2019-1276Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12760A deserialization vulnerability exists in the way parso thro…3.3
• CVE-2019-12762Xiaomi Mi 5s Plus devices allow attackers to trigger touchsc…4.2
• CVE-2019-12763The Security Camera CZ application through 1.6.8 for Android…
• CVE-2019-12764An issue was discovered in Joomla! before 3.9.7. The update …6.5
• CVE-2019-12765An issue was discovered in Joomla! before 3.9.7. The CSV exp…9.8
• CVE-2019-12766An issue was discovered in Joomla! before 3.9.7. The subform…6.1
• CVE-2019-12767An issue was discovered on D-Link DAP-1650 devices before 1.…9.8