CVE-2020-13661

Name of the Vulnerable Software and Affected Versions Telerik Fiddler versions prior to 5.0.20204

Description The issue allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by --utility-and-browser --utility-cmd-prefix= and the pathname of a locally installed program. The victim must interactively choose the Open On Browser option.

Recommendations For versions prior to 5.0.20204, update to version 5.0.20204 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Open On Browser option for hostnames with suspicious characters. Restrict access to locally installed programs to minimize the risk of exploitation.