CVE-2023-30844

Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints. This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint. On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1. Earlier versions of Mutagen are no longer supported and will not be patched. Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.

• CWE-150
• CWE-116

• https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6Release Notes
• https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1Release Notes
• https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2Vendor Advisory
• https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6Release Notes
• https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1Release Notes
• https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2Vendor Advisory

Published

May 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30839PrestaShop is an Open Source e-commerce web application. Ver…8.8
• CVE-2023-3084Cross-site Scripting (XSS) - Stored in GitHub repository nil…8.1
• CVE-2023-30840Fluid is an open source Kubernetes-native distributed datase…7.8
• CVE-2023-30841Baremetal Operator (BMO) is a bare metal host provisioning i…5.5
• CVE-2023-30842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-30843Payload is a free and open source headless content managemen…6.5
• CVE-2023-30845ESPv2 is a service proxy that provides API management capabi…9.8
• CVE-2023-30846typed-rest-client is a library for Node Rest and Http Client…7.5
• CVE-2023-30847H2O is an HTTP server. In versions 2.3.0-beta2 and prior, wh…8.2
• CVE-2023-30848Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30849Pimcore is an open source data and experience management pla…8.8
• CVE-2023-3085A vulnerability, which was classified as problematic, has be…6.1