CVE-2018-10992

CVE-2018-10992 is a critical argument-injection vulnerability affecting LilyPond versions up to 2.19.80. The flaw resides in the lilypond-invoke-editor component, which fails to properly validate strings before executing the program specified by the BROWSER environment variable. This allows remote attackers to inject arbitrary arguments, such as --proxy-pac-file, via a crafted URL, stemming from an incomplete fix for a previous vulnerability. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a network-based attack vector, low attack complexity, and requires no user interaction or privileges, potentially leading to full compromise of confidentiality, integrity, and availability. The EPSS score is low, indicating a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention.