---
id: CVE-2023-5557
title: 'Tracker-miners: sandbox escape'
summary: >-
  A flaw was found in the tracker-miners package. A weakness in the sandbox
  allows a maliciously-crafted file to execute code outside the sandbox if the
  tracker-extract process has first been compromised by a separate
  vulnerability.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-693
vendor: Red Hat
product: tracker-miners
affected:
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners (all versions)
  - tracker-miners
published: '2023-10-13'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:06:05.992Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-5557'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:7712'
    label: 'RHSA-2023:7712'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7713'
    label: 'RHSA-2023:7713'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7730'
    label: 'RHSA-2023:7730'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7731'
    label: 'RHSA-2023:7731'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7732'
    label: 'RHSA-2023:7732'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7733'
    label: 'RHSA-2023:7733'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7739'
    label: 'RHSA-2023:7739'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7744'
    label: 'RHSA-2023:7744'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-5557'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2243096'
    label: RHBZ#2243096
tags:
  - cve.org
epss: 0.00847
epssPercentile: 0.58264
ingestedAt: '2026-11-05T21:36:00.590Z'
---

## Overview

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

## Affected

- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners (all versions)`
- `tracker-miners`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.