CVE-2026-105841 is a High severity OS command injection in lrzsz, the XMODEM, YMODEM and ZMODEM file transfer package. Before 0.13.0, when lrz runs under a suffixed name such as lrztar, a sender can run commands as the receiving user through a crafted filename. Version 0.13.0 removed the pipe feature.
What's affected
- Package: lrzsz, a Unix XMODEM, YMODEM and ZMODEM implementation by Uwe Ohse.
- Affected: versions before 0.13.0.
- Fixed: 0.13.0 removed the lrz pipe execution feature. The project page lists 0.13.1 as the latest release as of October 2026.
- Condition: lrz is invoked under a suffixed name such as lrztar, which the NEWS file says only exists if the installer appended a string to the command name.
- Score: CVSS 7.5, High.
How to check if you're exposed
Find lrzsz installs and check how lrz is named on each.
command -v lrz rz lrztar
lrz --version
ls -l $(dirname $(command -v lrz)) | grep -i lr
dpkg -l | grep -i lrzsz
rpm -qa | grep -i lrzsz
The risky case is a copy or link of lrz with an extra suffix, for example one created to unpack received archives. If the only names present are lrz and rz, the NEWS file says the pipe execution feature was not reachable.
Check serial console tools, jump hosts, embedded devices and older lab machines, which are where ZMODEM is still used. Container images with legacy tooling can also carry it.
What to do now
- Upgrade lrzsz to 0.13.0 or later, and prefer the latest release, since the project notes 0.13.1 followed in October 2026.
- If you cannot upgrade, remove any suffixed copies or links of lrz such as lrztar.
- Only receive files over ZMODEM or YMODEM from senders you trust.
- Run file receiving as an unprivileged user in a directory that holds nothing sensitive.
- Check shell history and scripts that call a suffixed lrz for past use.
- Note that 0.13.0 also fixes several other security issues in lrz and lsz, so the upgrade is worth doing even if you do not use the pipe feature.
Why it matters
The record lists CWE-78, OS command injection. According to the record, the receive function passes the filename sent by the remote side to the C library popen call without escaping, so shell metacharacters in a filename become commands run as the receiving user.
The NEWS file describes this as a feature that was also insecure by design, inherited from the original public domain rzsz suite of the 1980s. It only worked if the installer chose a suffixed command name, which limits the exposure, but where it exists, the sender controls the command.
The NEWS file says the 0.13.0 release fixes a large number of security issues, and that two of them warrant an immediate update if you receive files from senders you do not fully trust. The record does not list this CVE as exploited in the wild. Old protocols that live on in rarely updated corners deserve an inventory.
Quick check
Is the plain lrz command affected?
The record ties the issue to lrz running under a suffixed name such as lrztar. The NEWS file says the feature was only reachable when the installer appended a string to the command name.
What did the project change?
The 0.13.0 NEWS says the lrz pipe execution feature was removed. It also notes that a different feature, ESC8 escaping, was removed again in 0.13.1.
Sources
Last reviewed: 18 October 2026.
