# rxvt-unicode vulnerability allows arbitrary code execution via escape sequences

> **Key takeaway:** A flaw in rxvt-unicode's handling of escape sequences allows attackers to execute arbitrary code as the logged-in user by displaying specially crafted text.

**Published:** 2026-11-03T17:37:49+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/rxvt-unicode-vulnerability-allows-arbitrary-code-execution-v.html 

## Summary
A security vulnerability has been identified in the rxvt-unicode terminal emulator, which incorrectly processes specific escape sequences. If a user views specially crafted text within the terminal, an attacker could potentially execute arbitrary code with the privileges of the logged-in user.

Canonical has released security updates to address CVE-2021-33477 for several legacy Ubuntu Long Term Support (LTS) releases. The fixes are primarily available through Ubuntu Pro via ESM (Expanded Security Maintenance) for versions 16.04, 18.04, and 20.04 LTS.

## Vulnerability details and mitigation
- **Defect Class:** The vulnerability stems from improper handling of terminal escape sequences, leading to potential arbitrary code execution.
- **Attack Vector:** An attacker can trigger the flaw by providing specially crafted input that is subsequently displayed in the terminal emulator.
- **Affected Versions:** The issue impacts rxvt-unicode versions used in Ubuntu 16.04 (xenial), 18.04 (bionic), and 20.04 (focal) LTS releases.
- **Remediation:** Users must perform a standard system update and restart the rxvt-unicode process to apply the fixes provided in versions 9.21-1ubuntu0.1~esm1, 9.22-3ubuntu0.1~esm1, or 9.22-6ubuntu0.1~esm1 depending on the distribution.

## Why it matters
This vulnerability highlights the risks associated with terminal emulators processing untrusted input, a common occurrence in modern workflows. Because the fix for these older LTS releases is tied to Ubuntu Pro's ESM Apps service, users on legacy systems must have an active subscription or ESM access to secure their terminal environments.