rootpwn

critical · CVSS v3 9.8 · CVSS v4 1

CVE-2026-55061

The uniget tool prior to version 0.27.6 improperly parses editor environment variables by splitting them on spaces and passing the resulting

Overview

The uniget tool prior to version 0.27.6 improperly parses editor environment variables by splitting them on spaces and passing the resulting tokens as arguments. This allows attackers who can influence the editor environment to supply unexpected arguments to the editor process. The flaw matters because it runs with the privileges of the uniget execution context, potentially leading to unauthorized actions.

Description

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

Impact

This vulnerability impacts confidentiality, integrity, and availability depending on the privileges of the uniget process and the arguments supplied. Users and administrators running uniget prior to version 0.27.6 are directly affected if local environment variables can be manipulated. Attackers cannot execute arbitrary shell commands due to Go os/exec limitations, but they can manipulate command-line arguments to the editor.

Remediation

Upgrade uniget to version 0.27.6 or later where the environment variable parsing is corrected. Audit systems for unauthorized modifications to the UNIGET_EDITOR and EDITOR environment variables. Ensure strict access controls on environments where installation and container management tools are executed.

Risk context

The vulnerability is rated as critical with a CVSS v3 score of 9.8, indicating severe potential risk if an attacker can control the local execution environment. Defenders should prioritize patching, as exploitation relies on environmental control which may be feasible in shared or multi-tenant systems.

Affected products

  • uniget

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
1
EPSS
—

uniget argument-injection environment-variables privilege-context code-execution container-tools

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis