GHSA-6wrm-x65g-hr4p

OpenStack Horizon RC file generation does not escape special characters in project names

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-55748

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	horizon	<= 25.7.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-55748 advisory
https://github.com/openstack/horizon package
https://launchpad.net/bugs/2152240 web
https://wiki.openstack.org/wiki/OSSN/OSSN-0097 web