VRT-2013-1003 (CVE-2013-6486): Pidgin uses clickable links to untrusted executables
Summary: Sourcefire's VRT-2013-1003 describes a remote code execution flaw in Pidgin 2.10.7's handling of file:// URLs on Windows, where a URL delivered over any Pidgin-supported protocol is passed to ShellExecute() when clicked. The file_clicked_cb function strips the file:// scheme before calling file_open_uri(), so the check meant to filter those URLs never matches, and the researchers achieved code execution using .jar files after Windows blocked .exe and .bat.
Key Takeaway: The attacker also controls the displayed link text, so the real destination of a clicked URL can be hidden from the user - and the flaw needs only a click in a chat window, with Java Runtime Environment installed on the target.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2013-6486
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026