OpenStack Horizon RC File Unescaped Characters Lead to RCE

Vulnerability Overview Vulnerability ID: OSSN-0097 Title: Horizon fails to escape special characters in project names when generating RC files Description: In OpenStack Horizon, when a user creates a project, the generated RC file (used to set environment variables) does not correctly escape special characters present in the project name. This can lead to a Remote Code Execution (RCE) risk. For example, if the project name contains special characters such as , these characters will be executed directly, allowing an attacker to run arbitrary commands in the user's local environment. Impact Scope Affected Component: OpenStack Dashboard (Horizon) Severity: High Impacted Users: All users who create projects using Horizon Remediation 1. Patch Content: - Modify templates to wrap all values in single quotes to prevent substitution or execution of values that resemble variables or commands. - Escape special characters in the shell filter to ensure that special characters in the project name do not break the generated RC file. 2. Patch Files: - - 3. Patch Details: - 0001-Quote-values-in-openrc.sh-templates.patch: - 0001-Escape-character-in-shellfilter-and-use-it-consistent.patch: 4. Patch Commit: - The patches have been merged into Horizon's master branch and stable branches (stable/2026.1, stable/2025.2, stable/2025.1). POC Code Summary This vulnerability involves OpenStack Horizon failing to correctly escape special characters in project names when generating RC files, potentially leading to remote code execution. The remediation includes modifying templates to wrap values in single quotes and escaping special characters in the shell filter. The patches have been merged into Horizon's master branch and stable branches.

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Horizon RC File Unescaped Characters Lead to RCE