Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in svxlink's reflector client. The talker_start/talker_stop handlers concatenate a server-supplied callsign into Tcl_Eval commands without sanitization. A malicious reflector server can inject TCL metacharacters to achieve arbitrary command execution. Affected versions: 24.02 through 26.05. Fixed in version 26.05.1.