CVE-2022-41138: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-41138 affects Zutty terminal emulator versions before 0.13. The vulnerability was discovered in September 2022 and allows arbitrary code execution through DECRQSS (Device Control Report Query Status String) commands in text written to the terminal (Gentoo GLSA, NVD).

The vulnerability exists due to improper handling of invalid DECRQSS commands. When invalid input is received, Zutty would echo it back to the console, allowing a malicious console application to invoke arbitrary commands. This is similar to CVE-2008-2383 which affected other terminal emulators (GitHub Commit).

A successful exploitation of this vulnerability allows untrusted text written to the Zutty terminal to achieve arbitrary code execution, potentially giving attackers complete control over the affected system (Gentoo GLSA).

The vulnerability was fixed in Zutty version 0.13 by modifying how invalid DECRQSS requests are handled - responding with a cancel instead of echoing the invalid input. Users should upgrade to version 0.13 or later as there are no known workarounds for affected versions (Gentoo GLSA, GitHub Commit).