Fabric Loader 0.14.24
Fixes a command injection vulnerability allowing malicious resource pack to unexpectedly execute code on Linux clients running vanilla Minecraft 1.16 (20w21a) -> 1.19.3 (23w04a)
It was recently found that the Tiny File Dialogs library is vulnerable to command injection techniques on Linux when invoked with untrusted data. This fix makes a small change in the create world MoreOptionsDialog
screen to pass a hardcoded string as the dialog title.
Modder's using the Tiny File Dialogs library in any Minecraft version should ensure that no untrusted strings (such as translated text) are used, this fix in loader does not apply to mods.
Many thanks to ThatGravyBoat and Moulberry for investigating this issue and reporting it to us in confidence.