FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Newsboat -- vulnerabilities

Affected packages
2.10	<=	newsboat	<	2.45

Details

VuXML ID	1be69a2e-c883-11f1-b5c5-3c7c3fba4204
Discovery	2026-10-04
Entry	2026-10-15

Newsboat Team reports:

(CVE ID Pending) Remote code execution via manual OPML import (--import-from-opml)

GHSA-4m8m-vj3m-hfxx: Remote code execution via OPML import (both manual --import-from-opml and opml-url config setting)

GHSA-pvg7-gjxf-23c9: Podboat could write at arbitrary paths

[source]

References

URL	https://github.com/newsboat/newsboat/security/advisories/GHSA-4m8m-vj3m-hfxx
URL	https://github.com/newsboat/newsboat/security/advisories/GHSA-pvg7-gjxf-23c9