Sam James <[email protected]> writes: > How is that different from just letting the process exit otherwise? > ~/.bash_logout will be used either way. If a process writes to arbitrary > bash init files, then all bets are off.
Sadly, if this reporter is determined to assign a CVE to this, I don't think they will run into issues. A word of caution that it is not worthwhile to try to resolve that if they do. I've made similar arguments to the reporter and CNA who had CVE-2026-53910 assigned to 'diff3' in diffutils. It requires a user to provide a bogus script to --diff3-program (which necessitates them being able to execute arbitrary code). The only results they demonstrated were that 'diff3' would exit with a non-zero exit status by crashing, when the "fixed" version does the same thing anyways but gracefully. Of course, that has been the least productive time I have spent in my life, and they refuse to retract it or remove the random mention of "remote code execution" in the description. > The signal handler should be made async-safe, but I don't think there's > any vulnerability here. Agreed. Collin
