Vulnerability · Published Jan 8, 2026 · Assigned by GitHub_M

CVE-2026-22035Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin

High 7.8

In plain English

A high-severity OS command injection in greenshot from greenshot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.0%top 36.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.

Affected products (as reported)

Vendor	Product	Versions
greenshot	greenshot	< 1.3.311

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/greenshot/greenshot/security/advisories/GHSA-7hvw-q8q5-gpmj x_refsource_CONFIRM
https://github.com/greenshot/greenshot/commit/5dedd5c9f0a9896fa0af1d4980d875a48bf432cb x_refsource_MISC
https://github.com/greenshot/greenshot/releases/tag/v1.3.311 x_refsource_MISC