{"api_version":"1","generated_at":"2026-07-23T12:01:00+00:00","cve":"CVE-2008-5986","urls":{"html":"https://cve.report/CVE-2008-5986","api":"https://cve.report/api/cve/CVE-2008-5986.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-5986","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-5986"},"summary":{"title":"CVE-2008-5986","description":"Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).","state":"PUBLISHED","assigner":"mitre","published_at":"2009-01-28 11:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.9","severity":"","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=481550","name":"https://bugzilla.redhat.com/show_bug.cgi?id=481550","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 481550 – CVE-2008-5986 csound: untrusted python modules search path","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/33446","name":"http://www.securityfocus.com/bid/33446","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Csound 'PySys_SetArgv' Remote Command Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/26/2","name":"http://www.openwall.com/lists/oss-security/2009/01/26/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany,\n\tcsound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359","name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"#504359 - csound: Python scripts load modules from current directory - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48276","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48276","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-5986","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-5986","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"5986","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"csound","cpe5":"csound","cpe6":"5.08.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T11:13:13.931Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"33446","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/33446"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=481550"},{"name":"csound-pysyssetargv-privilege-escalation(48276)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"},{"name":"[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2009/01/26/2"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-11-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983)."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"33446","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/33446"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=481550"},{"name":"csound-pysyssetargv-privilege-escalation(48276)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"},{"name":"[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2009/01/26/2"},{"tags":["x_refsource_CONFIRM"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-5986","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"33446","refsource":"BID","url":"http://www.securityfocus.com/bid/33446"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=481550","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=481550"},{"name":"csound-pysyssetargv-privilege-escalation(48276)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"},{"name":"[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2009/01/26/2"},{"name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359","refsource":"CONFIRM","url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-5986","datePublished":"2009-01-28T11:00:00.000Z","dateReserved":"2009-01-27T00:00:00.000Z","dateUpdated":"2024-08-07T11:13:13.931Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-01-28 11:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:csound:csound:5.08.2:*:*:*:*:*:*:*","matchCriteriaId":"CD401A94-40BB-45A8-A702-DE8710FD0A71"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"5986","Ordinal":"1","Title":"CVE-2008-5986","CVE":"CVE-2008-5986","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"5986","Ordinal":"1","NoteData":"Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).","Type":"Description","Title":"CVE-2008-5986"},{"CveYear":"2008","CveId":"5986","Ordinal":"2","NoteData":"2009-01-28","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"5986","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}