Post #1305491
2026-02-11 14:47 UTC
I HATE that the industry started calling these RCE (specifically "passive" RCE). It really muddies the waters.
This isn't a normal RCE where an attacker can remotely connect in and execute code. Those are very serious.
This is a passive RCE. Basically code injection from inappropriately parsing a file. And it doesn't need to be remote. You can use a local file.
Replies (1)
-
@Nighed@feddit.uk 2026-02-12 09:28
That's the opposite of how I would understand it though. If you said a passive RCE I would understand that as it being run without me doing anything - in this case, just having notepad open making me vulnerable.