CVE-2023-43091 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Code Injection via `service.json`. 💥 **Consequences**: Full system compromise. High CVSS (9.8). Critical integrity/availability loss.

Q: Root Cause? (CWE/Flaw)

🔍 **Root Cause**: CWE-79 (XSS/Injection). ⚠️ **Flaw**: Unsafe parsing of `service.json` config file. Malicious input executes as code.

Q: Who is affected? (Versions/Components)

📦 **Affected**: GNOME Maps 43.X (<43.7) & 44.X (<44.4). 🐧 **Platform**: GNOME/Linux desktop users.

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: Arbitrary Code Execution. 📂 **Data**: Full access to user context. No UI interaction needed. Total control.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: LOW. 🛑 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🌐 **Network**: Remote (AV:N).

Q: Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp**: No PoCs listed in data. ⚠️ **Risk**: High severity implies easy theoretical exploitation, but no wild exploits confirmed yet.

Q: How to self-check? (Features/Scanning)

🔎 **Check**: Scan for `service.json` in GNOME Maps install dirs. 📊 **Version**: Verify version < 43.7 or < 44.4. 🛠️ **Tool**: CVE scanners targeting CWE-79.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 🔗 **Patch**: GitLab commit d26cd77. 📝 **Ref**: RHBZ#2239091. Update to latest stable.

Q: What if no patch? (Workaround)

🛡️ **Workaround**: Disable GNOME Maps if possible. 🚫 **Config**: Restrict access to `service.json`. 🔒 **Sandbox**: Run in restricted container/VM.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 📅 **Priority**: Patch Immediately. ⚡ **Reason**: CVSS 9.8 + No Auth + Code Exec = High Impact.

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Code Injection via `service.json`. <br>💥 **Consequences**: Full system compromise. High CVSS (9.8). Critical integrity/availability loss.

Q2Root Cause? (CWE/Flaw)

🔍 **Root Cause**: CWE-79 (XSS/Injection). <br>⚠️ **Flaw**: Unsafe parsing of `service.json` config file. Malicious input executes as code.

Q3Who is affected? (Versions/Components)

📦 **Affected**: GNOME Maps 43.X (<43.7) & 44.X (<44.4). <br>🐧 **Platform**: GNOME/Linux desktop users.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Arbitrary Code Execution. <br>📂 **Data**: Full access to user context. No UI interaction needed. Total control.

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: LOW. <br>🛑 **Auth**: None required (PR:N). <br>🖱️ **UI**: None required (UI:N). <br>🌐 **Network**: Remote (AV:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp**: No PoCs listed in data. <br>⚠️ **Risk**: High severity implies easy theoretical exploitation, but no wild exploits confirmed yet.

Q7How to self-check? (Features/Scanning)

🔎 **Check**: Scan for `service.json` in GNOME Maps install dirs. <br>📊 **Version**: Verify version < 43.7 or < 44.4. <br>🛠️ **Tool**: CVE scanners targeting CWE-79.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. <br>🔗 **Patch**: GitLab commit d26cd77. <br>📝 **Ref**: RHBZ#2239091. Update to latest stable.

Q9What if no patch? (Workaround)

🛡️ **Workaround**: Disable GNOME Maps if possible. <br>🚫 **Config**: Restrict access to `service.json`. <br>🔒 **Sandbox**: Run in restricted container/VM.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. <br>📅 **Priority**: Patch Immediately. <br>⚡ **Reason**: CVSS 9.8 + No Auth + Code Exec = High Impact.

Continue exploring

Vulnerability detail Full AI analysis (login) CWE-79