The validate function of Secvisogram’s csaf-validator-lib in versions prior to 0.1.0 executes arbitrary functions passed via its arguments without restricting them to a trusted, predefined set (CWE-20). A high-privileged attacker can pass crafted arguments to the validate function of a locally installed Secvisogram, achieving arbitrary code execution and denial of service once the user triggers the validation. Version 0.1.0 introduced strict mode, restricting execution to library functions by default.

BSI advisory: BSI-2022-0004.