In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.

Hi, Security Note: Never set a handler that will blindly execute code or commands from the file being handled. Such behaviour will sooner than later lead to unintended code execution i.e. through a curious user trying to inspect a freshly downloaded file but running it by accident.

Keeping opening and executing separate actions helps with people protecting themselves from malware, the default handler is an opener, not a runner.

tl;dr of the rest of this: Most open-source programs (whether on accident or on purpose) seem to heed this advice. Some of them don't. Those that don't are quite useful for escaping sandboxes.

Some findings:

Argument injection in sensible-browser (CVE-2017-17512) [1] Argument injection in xdg-open (CVE-2017-18266) [1] Shell command injection in lilypond (CVE-2017-17523, CVE-2018-10992) [1] MIME type spoofing in Firefox/Thunderbird [2] Arbitrary file write in Stellarium file association (CVE-2023-28371) [3] Arbitrary code execution through kitty-open.desktop file association [5]

This type of issue is not uncommon.

[1] https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/ [2] https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/ Regards,

Gabriel