Bug 2493380 (CVE-2026-13412)

Summary: CVE-2026-13412 joe: Arbitrary command execution via malicious tags file
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2493381, 2493382    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-26 10:51:57 UTC 
JOE's tag-search feature (default keybinding ^K ;) reads a file literally named `tags` from the current working directory and parses whitespace-separated tag entries. The extracted FILE value is passed unchanged to JOE's internal file loader, which preserves a feature where filenames beginning with `!` are executed as shell commands via `/bin/sh -c`. Because the tag-file parser performs no validation of the FILE token, a crafted `tags` file whose FILE field begins with `!` triggers arbitrary command execution as the user running JOE the moment the victim performs a tag search that matches the malicious key. Affected components: joe/utag.c (dotag, dotagjump), joe/b.c (bfind, bload). Affected editors: joe, jmacs, jpico, jstar. The restricted editor rjoe is not exposed by default.