CVE-2023-35962

What it actually does

The flaw permits arbitrary OS command execution via command injection during decompression in the vcd2vzt utility when a specially crafted wave file is processed.

Why it matters to the business

Attackers gaining arbitrary command execution can compromise affected systems after a user opens a malicious file, risking data theft or further network access; low urgency given stable low EPSS, no KEV listing, and no ransomware association despite wide downstream use in ecosystems.

How an attack unfolds

An attacker creates a malicious wave file embedding OS commands that exploit the decompression logic in vcd2vzt; the victim opens the file triggering injection and command execution. No named threat actors are associated.

How to fix it

Update to fixed versions: parisneo/lollms (GIT) at commit 95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6. Avoid opening untrusted wave files until patched.

How to confirm the fix worked

Verify installed version or commit hash against the fixed commit; test with known-safe wave files and confirm absence of unexpected process execution during decompression.

Typical attack path

1. Craft malicious wave file with embedded commands targeting decompression
2. Deliver file to victim via email, download, or shared storage
3. Victim opens file using the vulnerable utility
4. Decompression triggers command injection and attacker payload execution

How to detect it

Review process creation logs and file access events around wave file handling for unexpected shell or command execution; look for anomalous child processes spawned by the utility.

What your security team should do

• Apply the listed fixed commit immediately across all instances
• Restrict opening of wave files from untrusted sources
• Monitor for new EPSS increases or KEV additions given exploit availability