Hi, Security Note: Never set a handler that will blindly execute code or commands from the file being handled. Such behaviour will sooner than later lead to unintended code execution i.e. through a curious user trying to inspect a freshly downloaded file but running it by accident.

Keeping opening and executing separate actions helps with people protecting themselves from malware, the default handler is an opener, not a runner.

tl;dr of the rest of this: Most open-source programs (whether on accident or on purpose) seem to heed this advice. Some of them don't. Those that don't are quite useful for escaping sandboxes.

Some findings:

Argument injection in sensible-browser (CVE-2017-17512) [1] Argument injection in xdg-open (CVE-2017-18266) [1] Shell command injection in lilypond (CVE-2017-17523, CVE-2018-10992) [1] MIME type spoofing in Firefox/Thunderbird [2] Arbitrary file write in Stellarium file association (CVE-2023-28371) [3] Arbitrary code execution through kitty-open.desktop file association [5]

This type of issue is not uncommon.

[1] https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/ [2] https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/ Regards,

Gabriel

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.

Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.

Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.