Description
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
TypesettingTools Aegisub
>= 3.2.0, < 3.5.0affected
References
- https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23 ↗
- https://github.com/TypesettingTools/Aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff ↗
- https://github.com/TypesettingTools/Aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6 ↗
- https://github.com/TypesettingTools/Aegisub/commit/e4099055711cce327840870c050ce46e58f4aee0 ↗