CVE-2018-20167

CVE-2018-20167 is a Remote Code Execution (RCE) vulnerability affecting Terminology versions prior to 1.3.1. It arises from improper handling of popmedia control sequences, specifically when an unsafe "cat README.md" command is used with "\e}pn". This allows an attacker to execute arbitrary code by crafting a malicious control sequence that leverages xdg-open to run executable files with registered MIME types. The vulnerability has a CVSSv3 score of 7.8 (High), indicating a significant risk. It requires user interaction (UI:R) and local access (AV:L), but has low attack complexity (AC:L) and can lead to high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered widespread attention.