Xpra Documentation

Security Policy

Supported Versions

Please ensure that you are using a supported version.

Distribution packages are usually outdated and full of vulnerabilities.

For a general overview, please first read security considerations as it pervades the architecture of the software.

To isolate applications which may be hostile, see the secure pod: the application runs in its own container, which only shares the X11 display with the X server and the xpra server. It can use the GPU for video encoding, see GPU acceleration and the secure pod for the security implications of each approach.

Reporting a Vulnerability

We understand and accept that some researchers prefer full-disclosure, but we would prefer to have a heads up prior to the release of the vulnerability details.

Critical bugs are usually fixed (if reproducible) within hours, rather than days or weeks. Though making a new release does take a little bit longer. Even more so for vulnerabilities.

Please contact security@xpra.org.

You can encrypt all communications with the following GPG key: 66EA1EA1A1323924 for xpra@xpra.org, the primary key fingerprint: B499 3B57 3231 48E3 7977 E5D8 7325 4CAD 1797 8FAF is the same as the one used for signing packages.

Notifications

To receive email notifications of pending security issues in any of the xpra projects, please send a request to security@xpra.org

Known issues

• CVE-2021-40839 rencode issue affected all MS Windows and MacOS binary packages produced before the fix
• RCE via xpra URLs
• file-transfer vulnerabilities
• encodings are not validated
• 2026-07-09: Multiple vulnerabilities in the Xpra client
• unsafe yaml.load packet decoder: all versions from 0.14 up to and including 4.0.x (and the 1.0.x, 3.1.x LTS branches) decode yaml packets with the unsafe loader, allowing remote code execution with PyYAML older than 5.4 - fixed in 4.1
• CVE-2020-8927 brotli decoder integer overflow: brotli packet and clipboard compression was added in 3.0, so all MS Windows and MacOS binary packages from 3.0 (September 2019) up to the builds made with brotli 1.0.9 (around September 2020) bundle a vulnerable decoder
• jpeg decoder heap overflow: the size of the RGB output buffer was computed with a 32-bit multiplication, so a crafted jpeg / jpega image declaring very large dimensions under-allocates it and the decoder writes past its end - from 4.3 onwards, fixed in 6.5.6
• vpx decoder heap over-read: a vp9 stream declaring a smaller frame than the one the decoder was initialized with makes it copy past the end of the planes, leaking heap memory into the decoded image - all versions, fixed in 6.5.6
• YUV444P to BGRX / RGBX heap overflow: the csc_cython converter allocated 3 bytes per pixel for a 4 bytes per pixel output, so painting YUV444P video frames without OpenGL overflows the heap - 6.0 to 6.5.0, fixed in 6.5.1
• mmap file confused deputy: the server opened whatever path an authenticated client named as its mmap file and wrote its own token back into it, so a client naming a file with known contents could corrupt any file owned by the server user, even over TCP, websocket or SSL - from 0.10 up to 6.5.2, fixed in 6.5.3
• unvalidated mmap chunks and OpenGL draw buffers: the chunk offsets and lengths, the mmap control header pointers and the rgb draw geometry all come from the peer and were not checked against the buffers, allowing reads outside of them - fixed in 6.5.3
• peercred authentication bypass: when no uid or gid was specified, peercred accepted any local user instead of only the socket owner, so any local user could connect to another user’s session through the abstract socket every Linux server creates automatically - 6.3.0 to 6.3.4, fixed in 6.3.5
• libpng CVE-2025-64720 and CVE-2025-66293: screen updates use libspng, but window icons and clipboard images are still parsed by Pillow using libpng, so a malicious server could send crafted icons, and any application could copy a crafted image to the clipboard while image sanitizing is enabled (the default) - MS Windows and MacOS binary packages built before December 2025, re-issued with libpng 1.6.52 for 6.4 and 5.1.4
• cross-site websocket hijacking: the Origin header of websocket connections was not validated, so any web page visited by the user could connect to a bind-ws socket (or a websocket upgradable one) and take over a session that does not require authentication - all versions, only fixed in 7.0 with the new http-origin option
• notifications from the server are not validated: a malicious server could make the client’s notification daemon load local files (app_icon URIs, img tags in the body), show links, impersonate local applications, bypass “do not disturb” or flood the desktop with notifications - all versions, fixed in 7.0
• strings and data from the peer are not validated: window titles, file names, client names, log messages and other strings could contain control characters, terminal escape sequences or bidi overrides, used to spoof window titles and file extensions or to inject into log files, and some lists (clipboard targets, printers, monitors, start menu) had no size limit - all versions, fixed in 7.0

Bundled libraries

The MS Windows builds are scanned every day for known vulnerabilities in the libraries they bundle, see CVEs for every vulnerability found and whether it applies.

False positives

Some vulnerabilities are reported, sometimes automatically, but cannot be exploited because the code is not actually used:

• braces v3.0.2 / micromatch v4.0.5 vulnerabilities
• xpra 4.0 wrongly detected as Trojan:Win32/Sprisky.D!cl
• bitdefender endpoint security tools malware false positive
• norton antivirus wrongly detected as Suspicious.Cloud.7.F

Hardening

• process level protections: prevent ptrace / core dumps
• rate limit authentication requests
• landlock the client
• hardening
• seccomp security support
• stricter validation of user supplied data
• immutable types
• features enforcing mode: block import of modules

Features and policy

• add authentication for web server scripts
• disable control channel
• fine grained control channel access
• allow to disable sending unneeded user data to the server
• new subcommand to generate SSL certificates easily
• trust some connections with unencrypted data
• option to control server shutdown permission per bind option
• override the username provided by the client without using --username or URI
• new gpg project key
• security issues handling
• AES v2
• throttle rude repository users
• SMS 2FA

This site is open source. Improve this page.