USN-8991-1: rxvt-unicode CVE-2021-33477 Fix Guide

Ubuntu has published USN-8991-1, a security notice for rxvt-unicode, the RXVT-like terminal emulator with Unicode support (often launched as urxvt). According to Ubuntu, the package mishandles certain escape sequences, so specially crafted text shown in the terminal could be used to run programs as the logged-in user. The notice was published on 3 November 2026 and references CVE-2021-33477.

This matters most to administrators and developers who use rxvt-unicode on Ubuntu 16.04, 18.04 or 20.04 LTS, including jump hosts and admin workstations where terminal output may come from untrusted sources such as logs, remote files or chat content. The fixes are delivered through Ubuntu Pro (ESM Apps).

At a glance

What happened

Ubuntu's notice says rxvt-unicode incorrectly handled certain escape sequences. An attacker could possibly use this to execute arbitrary code if a user displayed specially crafted text in the terminal. Ubuntu's overview summarizes it as the terminal being made to run programs as your login.

The notice does not give a CVSS score, and the research does not say whether the flaw is being exploited. Treat both as unknown rather than assuming either way. Only one publisher, Ubuntu itself, is covered here, so there is no independent confirmation beyond the vendor notice.

Why terminal escape sequences are risky

Terminals do not just print characters. Special byte sequences, called escape sequences, tell the terminal to move the cursor, change colors, set titles and more. A terminal emulator has to parse them, and any parsing mistake can become a security problem when the text comes from someone else. Commands like cat on an unknown file, reading a log, or viewing output from a remote service all push untrusted bytes into that parser.

Ubuntu does not describe the exact mechanism, and this article does not go further than the advisory. The practical lesson is simple: displaying text in a vulnerable terminal can be enough, with no download or click required beyond the display itself.

Who is affected

Only systems that have the rxvt-unicode package installed, and use it, are in scope. Ubuntu lists these package versions as the fixed ones:

All three releases are covered by ESM Apps, so the fix is available with Ubuntu Pro. Ubuntu notes that Pro is free for up to five machines. For these releases it also says a community fix might become publicly available in the future, which is not a commitment.

How to check your exposure

This read-only command lists installed rxvt-unicode packages and their versions on Debian-based systems such as Ubuntu. No output means the package is not installed. Compare any version shown with the table above.

dpkg -l | grep rxvt-unicode

If you are unsure whether Ubuntu Pro is attached on a machine, this command shows the status of Pro services, including ESM Apps.

pro status

What to do now

Ubuntu says that after a standard system update you need to restart rxvt-unicode so the changes take effect. Existing terminal windows keep running the old code until they are closed.

Once Ubuntu Pro with ESM Apps is enabled, update the package with the standard tools. This refreshes package lists and upgrades only rxvt-unicode; it needs root privileges.

sudo apt update && sudo apt install --only-upgrade rxvt-unicode

Afterward, rerun the dpkg check and confirm the version matches the fixed version for your release, then close and reopen all rxvt-unicode windows.

Detection and follow-up

The advisory gives no indicators of compromise, so there is no specific log signature to hunt for. If a workstation or jump host ran an unpatched rxvt-unicode and displayed content from an untrusted source, review that user's recent shell history, new cron entries, SSH authorized keys and unexpected processes. Our guide on what to do when a website is hacked covers a broader response process if you find signs of compromise.

Admin workstations are a path into the servers and sites they manage, so keep them patched alongside your web stack. You can also review the public side of your sites with the free security headers checker or read more security news and patch walkthroughs on the Webforta blog.

Timeline

• 3 November 2026: Ubuntu publishes USN-8991-1 for rxvt-unicode, referencing CVE-2021-33477.

The research gives no earlier disclosure or discovery dates, so none are stated here.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

1. USN-8991-1: rxvt-unicode vulnerability | Ubuntu security notices | Ubuntuubuntu.com · 3 November 2026

• Ubuntu
• USN
• rxvt-unicode
• CVE-2021-33477
• Linux
• terminal