Is RCE Really Just Low Severity?
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A security researcher discovered a command injection vulnerability in the {fmt} C++ library's `fmt::say` helper, which passes formatted strings directly to `std::system`. The post walks through the finding, explains why the researcher initially rated it critical (CVSS 9.8) while the maintainers rated it Low (CVSS ~3.3), and uses the case to illustrate how impact and exposure are separate dimensions of severity. The helper was macOS-only, lived in an optional header, and was removed in the fix. The author argues that library-level and application-level severity can legitimately differ, and raises concern that low library-level scores may cause real application-level risks to be overlooked.
