From andrew.baerg at gmail.com  Sun Aug  9 03:19:39 2026
From: andrew.baerg at gmail.com (Andrew Baerg)
Date: Sat, 8 Aug 2026 21:19:39 -0600
Subject: [ic] Remote code execution vulnerability patched
Message-ID: <31e7e53e-15ef-408a-bb26-15aa053bfb6d@gmail.com>

Hi all,

A critical remote code execution (RCE) vulnerability was found in the 
?quick question? admin feature. In default installations arbitrary Perl 
code can be injected and executed server-side by unauthenticated users. 
The Perl code normally runs within a Safe container which limits the 
scope of what it can do, unless the non-default AllowGlobal directive is 
configured for the catalog being accessed.

You are encouraged to immediately remediate all Interchange deployments. 
The Interchange Git repository contains the fix, and you can apply it by 
patching or replacing the page file 
dist/lib/UI/pages/admin/quick_question.html with the hardened version 
-?https://github.com/interchange/interchange/commit/65b6ea9d3761dd1fd2071c962819562afa335e4e

--