{"id":"CVE-2023-39150","details":"ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.","modified":"2026-08-27T10:10:45.970458Z","published":"2023-09-12T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39150.json"},"references":[{"type":"WEB","url":"https://gist.github.com/dgl/081cf503dc635df39d844e058a6d4c88"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39150.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39150"},{"type":"FIX","url":"https://github.com/Maximus5/ConEmu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ConEmu/ConEmu","events":[{"introduced":"0"},{"fixed":"90f76807d5e1862f670a65273f8d5ffc6693b4d3"}],"database_specific":{"cpe":"cpe:2.3:a:maximus5:conemu:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"23.07.24"}],"source":"CPE_RANGE"}}],"versions":["v23.07.23","v22.12.18","v22.08.07","v-alpha","v22.04.18","v-preview","v22.03.08","v21.09.12","v21.09.05","v21.08.22","v21.08.16","v21.07.18","v21.06.27","v21.06.24","v21.06.20","v21.04.22","v21.03.14","v21.03.12","v21.03.04","v21.02.06","v21.02.02","v21.01.28","v21.01.12","v21.01.11","v21.01.09","v20.11.24","v20.11.23a","v20.11.23","v20.11.22","v20.11.01","v20.10.11","v20.09.28","guimacro-test","v20.07.13","v20.06.15","v20.06.04","v19.10.12","v19.07.14","v19.06.23","v19.05.26","v19.03.31","v19.03.26","v19.03.24","v19.03.10","v19.03.03","v19.03.01","v19.02.25","v19.02.24","v19.02.17","v19.01.08","v18.06.26","v18.06.17","v18.05.28","v18.05.06","v18.05.03","v18.04.29","v18.04.27","v18.04.22","v18.04.18","v18.04.16","v18.04.15","v18.04.11","v18.04.09","v18.04.08","v18.03.18","v18.03.09","v18.02.06","v18.01.31","v18.01.30","v18.01.14","v18.01.11","v18.01.08","v17.12.26","v17.12.17","v17.12.05","v17.12.03","v17.11.17","v17.11.09","v17.10.25","v17.09.10","v17.08.19","v17.08.14","v17.08.07","v17.08.05","v17.07.30","v17.07.23","v17.07.09","v17.07.05","v17.06.22","v17.06.05","v17.05.17","v17.04.02","v17.03.26","v17.03.16","v17.03.05","v17.02.27","v17.01.18","v16.12.06","v16.12.03","v16.10.22","v16.10.09a","v16.10.09","v16.10.02","v16.09.14","v16.09.13","v16.09.04","v16.08.28","v16.07.24","v16.07.10","v16.07.07","v16.06.19","v16.06.12","v16.06.09","v16.06.07","v16.06.05","v16.05.29","v16.05.22","v16.05.15","v16.05.04","v16.05.03","v16.04.28","v16.04.16","v16.04.13","v16.04.11","v16.04.03a","v16.04.03","v16.03.29","v16.03.28","v16.03.27","v16.03.24","v16.03.13","v16.03.10","v16.03.08","v16.03.01","v16.02.28","v16.02.22","v16.02.19","v16.02.18","v16.02.17","v16.02.11","v16.02.07","v16.02.04","v16.02.02","v16.01.24","v16.01.11","v15.12.24","v15.12.22","v15.12.17","v15.12.10","v15.12.08","v15.12.07","v15.12.05","v15.12.02","v15.11.29","v15.11.26","v15.11.22","v15.11.19","v15.11.15","v15.11.09","v15.11.01","v15.10.29","v15.10.25","v15.10.15","v15.10.06","v15.09.13","v15.09.10","v15.09.08","v15.08.21","v15.08.13","v15.08.16","v15.08.14","v15.07.28","v15.07.27","v15.07.22","v15.07.16","v15.07.07","v15.07.05","v15.07.01","v15.06.29","v15.06.21","v15.06.10","v15.06.08","v15.05.13","v15.05.04","v15.04.28","v15.04.27","v15.04.20","v15.04.19","v15.04.16","v15.04.09","v15.04.08","v15.04.05","v15.03.31","v15.03.27","v15.03.19","v15.03.16","v15.03.11","v15.03.10","v15.03.09","v15.03.07a","v15.03.07","v15.03.05","v15.03.03","v15.03.02b","v15.03.02a","v15.03.02","v15.02.24a","v15.02.24","v15.02.18","v15.02.16","v15.02.15","v15.02.09","v15.02.06","v15.02.03","v15.01.28","v15.01.19a","v15.01.19","v15.01.11","v14.12.21","v14.12.19","v14.12.17","v14.12.16","common-149","v14.12.08","v14.12.06","v14.12.04","v14.12.03","v14.12.01","common-147","v14.11.30","v14.11.26","v14.11.25","v14.11.23","v14.11.17","v14.10.16","v14.11.16","v14.11.15","v14.11.14","v14.11.13","v14.11.12","v14.11.11","v14.11.10","v14.11.09","v14.11.07","v14.11.06","v14.11.05","v14.11.04a","v14.11.04","v14.11.03","v14.11.01","common-143","v14.10.29","v14.10.28","v14.10.25","v14.10.22","v14.10.20","v14.10.17","v14.10.13","v14.10.12","v14.10.04","v14.10.02","v14.10.01","v14.09.23","v14.09.22","v14.09.14","v14.09.09","v14.09.08","v14.09.05","common-140","v14.09.03","v14.08.19","v14.08.18","v14.08.15","v14.08.14","v14.08.12","v14.08.11","v14.08.10","v14.07.23","v14.07.07","v14.07.03","v14.07.01","v14.06.28","v14.06.15","v14.06.12","v14.06.02","v14.05.29","v14.05.28","v14.05.23","v14.05.22","v14.05.19","common-138","v14.05.05","common-137","v14.04.29","v14.04.28","v14.04.22","v14.04.16","v14.04.14","v14.04.12","v14.04.04","v14.04.03","v14.03.27","common-136","dbg-test2","Issue1527","v14.03.10","v14.03.04","v14.03.02","v14.02.27","v14.02.25","v14.02.23","v14.02.20","rcon-args","v14.02.16b","v14.02.16a","v14.02.16","v14.02.14","v14.02.05","v14.02.03","v14.02.02","v14.01.28","v14.01.27","v14.01.24-preview","v14.01.24","v14.01.23","v14.01.22","v14.01.17","v14.01.16","v14.01.14a-preview","v14.01.14","v14.01.13","v14.01.12a","v14.01.12","v14.01.09","v14.01.06","v14.01.04","v13.12.25","utf-8-begin","v13.12.23","v13.11.25-preview","v13.12.19","v13.12.15-preview","v13.12.15","v13.12.11","v13.12.07","v13.12.05","v13.12.02","common-135","v13.11.29","common-134","v13.11.19","init_git","v13.11.17","v13.11.15","v13.11.14","v13.11.07","common-133","init_copy"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39150.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/conemu/conemu","events":[{"introduced":"0"},{"fixed":"60683a186628ffaa7689fcb64b3c38ced69287c1"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v23.07.23","v22.12.18","v22.08.07","v-alpha","v22.04.18","v-preview","v22.03.08","v21.09.12","v21.09.05","v21.08.22","v21.08.16","v21.07.18","v21.06.27","v21.06.24","v21.06.20","v21.04.22","v21.03.14","v21.03.12","v21.03.04","v21.02.06","v21.02.02","v21.01.28","v21.01.12","v21.01.11","v21.01.09","v20.11.24","v20.11.23a","v20.11.23","v20.11.22","v20.11.01","v20.10.11","v20.09.28","guimacro-test","v20.07.13","v20.06.15","v20.06.04","v19.10.12","v19.07.14","v19.06.23","v19.05.26","v19.03.31","v19.03.26","v19.03.24","v19.03.10","v19.03.03","v19.03.01","v19.02.25","v19.02.24","v19.02.17","v19.01.08","v18.06.26","v18.06.17","v18.05.28","v18.05.06","v18.05.03","v18.04.29","v18.04.27","v18.04.22","v18.04.18","v18.04.16","v18.04.15","v18.04.11","v18.04.09","v18.04.08","v18.03.18","v18.03.09","v18.02.06","v18.01.31","v18.01.30","v18.01.14","v18.01.11","v18.01.08","v17.12.26","v17.12.17","v17.12.05","v17.12.03","v17.11.17","v17.11.09","v17.10.25","v17.09.10","v17.08.19","v17.08.14","v17.08.07","v17.08.05","v17.07.30","v17.07.23","v17.07.09","v17.07.05","v17.06.22","v17.06.05","v17.05.17","v17.04.02","v17.03.26","v17.03.16","v17.03.05","v17.02.27","v17.01.18","v16.12.06","v16.12.03","v16.10.22","v16.10.09a","v16.10.09","v16.10.02","v16.09.14","v16.09.13","v16.09.04","v16.08.28","v16.07.24","v16.07.10","v16.07.07","v16.06.19","v16.06.12","v16.06.09","v16.06.07","v16.06.05","v16.05.29","v16.05.22","v16.05.15","v16.05.04","v16.05.03","v16.04.28","v16.04.16","v16.04.13","v16.04.11","v16.04.03a","v16.04.03","v16.03.29","v16.03.28","v16.03.27","v16.03.24","v16.03.13","v16.03.10","v16.03.08","v16.03.01","v16.02.28","v16.02.22","v16.02.19","v16.02.18","v16.02.17","v16.02.11","v16.02.07","v16.02.04","v16.02.02","v16.01.24","v16.01.11","v15.12.24","v15.12.22","v15.12.17","v15.12.10","v15.12.08","v15.12.07","v15.12.05","v15.12.02","v15.11.29","v15.11.26","v15.11.22","v15.11.19","v15.11.15","v15.11.09","v15.11.01","v15.10.29","v15.10.25","v15.10.15","v15.10.06","v15.09.13","v15.09.10","v15.09.08","v15.08.21","v15.08.13","v15.08.16","v15.08.14","v15.07.28","v15.07.27","v15.07.22","v15.07.16","v15.07.07","v15.07.05","v15.07.01","v15.06.29","v15.06.21","v15.06.10","v15.06.08","v15.05.13","v15.05.04","v15.04.28","v15.04.27","v15.04.20","v15.04.19","v15.04.16","v15.04.09","v15.04.08","v15.04.05","v15.03.31","v15.03.27","v15.03.19","v15.03.16","v15.03.11","v15.03.10","v15.03.09","v15.03.07a","v15.03.07","v15.03.05","v15.03.03","v15.03.02b","v15.03.02a","v15.03.02","v15.02.24a","v15.02.24","v15.02.18","v15.02.16","v15.02.15","v15.02.09","v15.02.06","v15.02.03","v15.01.28","v15.01.19a","v15.01.19","v15.01.11","v14.12.21","v14.12.19","v14.12.17","v14.12.16","common-149","v14.12.08","v14.12.06","v14.12.04","v14.12.03","v14.12.01","common-147","v14.11.30","v14.11.26","v14.11.25","v14.11.23","v14.11.17","v14.10.16","v14.11.16","v14.11.15","v14.11.14","v14.11.13","v14.11.12","v14.11.11","v14.11.10","v14.11.09","v14.11.07","v14.11.06","v14.11.05","v14.11.04a","v14.11.04","v14.11.03","v14.11.01","common-143","v14.10.29","v14.10.28","v14.10.25","v14.10.22","v14.10.20","v14.10.17","v14.10.13","v14.10.12","v14.10.04","v14.10.02","v14.10.01","v14.09.23","v14.09.22","v14.09.14","v14.09.09","v14.09.08","v14.09.05","common-140","v14.09.03","v14.08.19","v14.08.18","v14.08.15","v14.08.14","v14.08.12","v14.08.11","v14.08.10","v14.07.23","v14.07.07","v14.07.03","v14.07.01","v14.06.28","v14.06.15","v14.06.12","v14.06.02","v14.05.29","v14.05.28","v14.05.23","v14.05.22","v14.05.19","common-138","v14.05.05","common-137","v14.04.29","v14.04.28","v14.04.22","v14.04.16","v14.04.14","v14.04.12","v14.04.04","v14.04.03","v14.03.27","common-136","dbg-test2","Issue1527","v14.03.10","v14.03.04","v14.03.02","v14.02.27","v14.02.25","v14.02.23","v14.02.20","rcon-args","v14.02.16b","v14.02.16a","v14.02.16","v14.02.14","v14.02.05","v14.02.03","v14.02.02","v14.01.28","v14.01.27","v14.01.24-preview","v14.01.24","v14.01.23","v14.01.22","v14.01.17","v14.01.16","v14.01.14a-preview","v14.01.14","v14.01.13","v14.01.12a","v14.01.12","v14.01.09","v14.01.06","v14.01.04","v13.12.25","utf-8-begin","v13.12.23","v13.11.25-preview","v13.12.19","v13.12.15-preview","v13.12.15","v13.12.11","v13.12.07","v13.12.05","v13.12.02","common-135","v13.11.29","common-134","v13.11.19","init_git","v13.11.17","v13.11.15","v13.11.14","v13.11.07","common-133","init_copy"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39150.json","vanir_signatures_modified":"2026-08-27T10:10:45Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/conemu/conemu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1","target":{"file":"src/ConEmuCD/ConAnsiImpl.cpp","function":"SrvAnsiImpl::ReportString"},"deprecated":false,"digest":{"function_hash":"236050266693658837904020056679501320995","length":843},"id":"CVE-2023-39150-146f0129"},{"digest":{"line_hashes":["276735128647626600038641527703620279184","189055906016559606029926632905606256321","225659710436854024509446302234888933330","60051500651401967419131112798734456981","216225919381866589900664575215532652285"],"threshold":0.9},"id":"CVE-2023-39150-d0b55418","signature_type":"Line","signature_version":"v1","source":"https://github.com/conemu/conemu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1","target":{"file":"src/ConEmuCD/ConAnsiImpl.cpp"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["323038792857170766104563082758013077727","137411922499104661692274094547256715283","225659710436854024509446302234888933330","60051500651401967419131112798734456981"],"threshold":0.9},"id":"CVE-2023-39150-d0c93692","signature_type":"Line","signature_version":"v1","source":"https://github.com/conemu/conemu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1","target":{"file":"src/ConEmuHk/Ansi.cpp"}},{"deprecated":false,"digest":{"function_hash":"107120160089813513627726103293137038458","length":968},"id":"CVE-2023-39150-f034434a","signature_type":"Function","signature_version":"v1","source":"https://github.com/conemu/conemu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1","target":{"file":"src/ConEmuHk/Ansi.cpp","function":"CEAnsi::ReportString"}}]}}],"schema_version":"1.9.0"}