CVE-2023-50254

Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.

• CWE-22
• CWE-27
• CWE-22

• https://github.com/linuxdeepin/deepin-reader/commit/4db7a079fb7bd77257b1b9208a7ab26aade8fe04Patch
• https://github.com/linuxdeepin/deepin-reader/commit/c192fd20a2fe4003e0581c3164489a89e06420c6Patch
• https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-q9jr-726g-9495Exploit, Vendor Advisory
• https://github.com/linuxdeepin/deepin-reader/commit/4db7a079fb7bd77257b1b9208a7ab26aade8fe04Patch
• https://github.com/linuxdeepin/deepin-reader/commit/c192fd20a2fe4003e0581c3164489a89e06420c6Patch
• https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-q9jr-726g-9495Exploit, Vendor Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50249Sentry-Javascript is official Sentry SDKs for JavaScript. A …7.5
• CVE-2023-5025A vulnerability was found in KOHA up to 23.05.03. It has bee…5.4
• CVE-2023-50250Cacti is an open source operational monitoring and fault man…6.1
• CVE-2023-50251php-svg-lib is an SVG file parsing / rendering library. Prio…7.5
• CVE-2023-50252php-svg-lib is an SVG file parsing / rendering library. Prio…9.8
• CVE-2023-50253Laf is a cloud development platform. In the Laf version desi…6.5
• CVE-2023-50255Deepin-Compressor is the default archive manager of Deepin L…7.8
• CVE-2023-50256Froxlor is open source server administration software. Prior…7.5
• CVE-2023-50257eProsima Fast DDS (formerly Fast RTPS) is a C++ implementati…8.1
• CVE-2023-50258Medusa is an automatic video library manager for TV shows. V…5.3
• CVE-2023-50259Medusa is an automatic video library manager for TV shows. V…5.3
• CVE-2023-5026A vulnerability classified as problematic has been found in …6.1