Bug 2513802 (CVE-2026-73147)

Summary: CVE-2026-73147 svxlink: svxlink: Remote code execution via TCL command injection in reflector client
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in svxlink's reflector client. The talker_start and talker_stop event handlers directly concatenate a server-supplied talker callsign into Tcl_Eval commands without any sanitization or escaping. A malicious or compromised reflector server can supply a crafted callsign containing TCL metacharacters to achieve arbitrary OS command execution with the privileges of the svxlink process.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2513816    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-11 07:32:06 UTC
A flaw was found in svxlink's reflector client. The talker_start/talker_stop handlers concatenate a server-supplied callsign into Tcl_Eval commands without sanitization. A malicious reflector server can inject TCL metacharacters to achieve arbitrary command execution. Affected versions: 24.02 through 26.05. Fixed in version 26.05.1.