AIKIDO-2026-101504
fmtlib.fmt is vulnerable to OS Command Injection
33
Low Risk
This Affects:
fmtlib.fmtTL;DR
The fmt::say helper in <fmt/os.h> builds a shell command by interpolating its argument into a say "..." string and passes it to std::system. On macOS the argument is placed inside the double-quoted command without escaping, so input can break out of the quoted context. Before the fix, input passed to this helper could run arbitrary shell commands with the privileges of the calling process. The fix removes the unsafe unsanitized std::system invocation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, build on macOS and pass externally influenced input to fmt::say from <fmt/os.h>.
Background info
fmtlib.fmt is vulnerable to OS Command Injection in versions 8.0.0 - 11.2.0.
How to fix this
Upgrade the fmtlib.fmt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant