CVE-2014-2886

no score yetEPSS 2.2%

nongnu gksu: no CVSS score yet. EPSS 2.2% chance of exploitation in the next 30 days.

GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2014-09-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nongnu:gksu

References

http://savannah.nongnu.org/bugs/?40023
https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu
https://launchpad.net/bugs/1186676
https://security.gentoo.org/glsa/201812-10
http://savannah.nongnu.org/bugs/?40023

Check your stack JSON