Vendor
Fluxbox versions 1.3.7 and earlier are vulnerable to OS command injection via crafted style files, allowing arbitrary command execution through unsafe concatenation in the fbsetbg utility.