CVE catalog

CVE-2022-41138

zutty: CVE-2022-41138

In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	zutty	sid	`0.16.7.20260620+dfsg1-1`	fixed
Debian	zutty	forky	`0.16.7.20260620+dfsg1-1`	fixed
Debian	zutty	trixie	`0.16.2.20241020+dfsg1-1`	fixed
Debian	zutty	bookworm	`0.14.0.20230218+dfsg1-1`	fixed
Ubuntu	zutty	pro	`0.10.20211016.133334+dfsg1-1`	vulnerable
Ubuntu	zutty	pro	`0.11.2.20220109.192032+dfsg1-1`	vulnerable
Ubuntu	zutty	pro	`0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1`	fixed
Ubuntu	zutty	pro	`0.10.20211016.133334+dfsg1-1`	vulnerable
Ubuntu	zutty	pro	`0.11.2.20220109.192032+dfsg1-1`	vulnerable
Ubuntu	zutty	pro	`0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1`	fixed

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	zutty	source	sid	`0.13.0.20220910.112547+dfsg1-1`	not yet assigned	Not reported	Not reported
Debian	zutty	source	forky	`0.13.0.20220910.112547+dfsg1-1`	not yet assigned	Not reported	Not reported
Debian	zutty	source	trixie	`0.13.0.20220910.112547+dfsg1-1`	not yet assigned	Not reported	Not reported
Debian	zutty	source	bookworm	`0.13.0.20220910.112547+dfsg1-1`	not yet assigned	Not reported	Not reported
Ubuntu	zutty	deb	pro	`0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1`	Not reported	USN-8078-1	Not reported
Ubuntu	zutty	deb	pro	`0.11.2.20220109.192032+dfsg1-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2022-41138	Not reported

Observed: Oct 23, 2026, 6:29:48 PM UTC