CVE-2026-79079: CrossWire Xiphos RCE Vulnerability

CVE-2026-79079 Overview

CVE-2026-79079 is a local code execution vulnerability affecting CrossWire Xiphos versions 4.3.2 and earlier. Xiphos is an open-source Bible study application built on the SWORD Project library. The flaw resides in the src/main/url.cc and src/gtk/menu_popup.c components and is categorized as an OS command injection issue [CWE-78]. A local attacker with low privileges can leverage the vulnerability to execute arbitrary code on the host without user interaction.

Critical Impact
Local attackers can execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

CrossWire Xiphos versions <= 4.3.2
Affected component: src/main/url.cc
Affected component: src/gtk/menu_popup.c

Discovery Timeline

2026-09-21 - CVE-2026-79079 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79079

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in an OS command, classified under [CWE-78]. Xiphos processes URL strings and menu-driven actions through the src/main/url.cc and src/gtk/menu_popup.c source files. Attacker-controlled input reaches an underlying shell or command execution routine without adequate sanitization. Because Xiphos runs with the privileges of the invoking user, injected commands execute in that user's context.

Exploitation does not require network access. The attack requires local access and low privileges, but no user interaction is needed once the crafted content is processed. Successful exploitation grants arbitrary code execution and can be chained with privilege escalation flaws to move from a standard user to root.

Root Cause

The root cause is unsafe construction of OS command strings from untrusted input inside url.cc and menu_popup.c. When URL handlers or menu popup logic build command lines that include user-influenced data, shell metacharacters are not filtered or escaped. The upstream fix in the CrossWire Xiphos repository refactors how these command strings are assembled and passed to the operating system.

Attack Vector

An attacker crafts a malicious URL, module reference, or menu-triggered payload containing shell metacharacters. When Xiphos processes the item through the vulnerable URL handling or popup menu code path, the injected commands execute. Delivery mechanisms include locally staged Bible study modules, imported bookmarks, or crafted content that is opened by the target user.

Refer to the GitHub Pull Request Commits and the GitHub Gist Code Snippet for technical details of the vulnerable code paths and the corresponding fix.

Detection Methods for CVE-2026-79079

Indicators of Compromise

Unexpected child processes spawned by the xiphos binary, especially shells such as sh, bash, or interpreters like python and perl.
Xiphos process writing to or reading from files outside its normal profile directories.
Outbound network connections initiated by child processes of xiphos shortly after opening a module or URL.

Detection Strategies

Monitor process lineage for xiphos parent processes launching command interpreters or scripting engines.
Inspect command-line arguments passed to child processes for shell metacharacters such as ;, |, `, and $().
Alert on Xiphos-triggered execution of binaries commonly abused for living-off-the-land activity, including curl, wget, nc, and bash -c.

Monitoring Recommendations

Enable Linux auditd or eBPF-based telemetry to capture execve events with full argument context on systems where Xiphos is installed.
Track file system writes by the Xiphos process to directories outside ~/.xiphos and ~/.sword.
Correlate user session activity with Xiphos process events to identify anomalous local execution patterns.

How to Mitigate CVE-2026-79079

Immediate Actions Required

Inventory endpoints for CrossWire Xiphos installations and identify versions at or below 4.3.2.
Apply the upstream patch from CrossWire Xiphos pull request #1314 once packaged by your Linux distribution.
Restrict opening of untrusted Bible modules, bookmarks, or URLs in Xiphos until the patch is deployed.

Patch Information

The fix is available in the CrossWire Xiphos source tree via the commit referenced in GitHub Pull Request Commits. Rebuild Xiphos from source with the patch applied, or upgrade to a distribution package that incorporates the fix beyond version 4.3.2.

Workarounds

Remove or disable Xiphos on multi-user systems until the patched version is deployed.
Run Xiphos under a dedicated low-privilege account with restricted file system and network access.
Enforce mandatory access control policies such as AppArmor or SELinux profiles that limit which binaries Xiphos may execute.

bash

# Example AppArmor snippet restricting child process execution for xiphos
/usr/bin/xiphos {
    # Deny execution of common shells and interpreters
    deny /bin/sh x,
    deny /bin/bash x,
    deny /usr/bin/python* x,
    deny /usr/bin/perl x,

    # Confine writable paths
    owner @{HOME}/.xiphos/** rw,
    owner @{HOME}/.sword/** rw,
}