‘Trojan Source’ Bug Threatens the Security of All Code
Summary: Researchers at the University of Cambridge found that most compilers and many development environments are vulnerable to an attack, dubbed Trojan Source, that uses Unicode's Bidi override characters placed inside comments and strings to make source code display logic that differs from its actual logic. The flaw is tracked as CVE-2021-42574 and CVE-2021-42694, and of the nineteen software suppliers the researchers engaged, nine committed to releasing a patch.
What you should know: The Bidi override characters survive copy-and-paste on most browsers, editors and operating systems, so a developer pulling code from an untrusted source can introduce an invisible vulnerability that renders as perfectly acceptable to a human reviewer. The researchers found no evidence of exploitation yet, but as Matthew Green noted, there were no defenses to it before this disclosure.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026