CVE-2013-1436: Xmonad Xmonad-Contrab

High severity, CVSS 7.5. EPSS: 9% chance of exploitation in the next 30 days.

The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.

Affected products

• Xmonad Xmonad-Contrab: up to and including 0.11.1; version 0.11 only

Published 2014-10-06. Last modified 2026-06-16.