CVE-2014-3121: Marc Lehmann Rxvt-Unicode

High severity, CVSS 7.6. EPSS: 4.1% chance of exploitation in the next 30 days.

rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.

Affected products

• Marc Lehmann Rxvt-Unicode: up to and including 9.19; version 9.0 only; version 9.01 only; version 9.02 only; version 9.05 only; version 9.06 only; …

Published 2014-05-14. Last modified 2026-06-17.