CVE-2026-55061— uniget: EDITOR Command Injection in uniget CLI
Quick assessment
Affected
uniget-org cli
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
是一个用于容器工具的通用安装程序和更新器。在 0.27.6 版本之前， 中的 命令会使用 解析环境变量 或 ，并将每个以空格分隔的后缀作为参数传递给所选编辑器可执行文件。能够影响编辑器环境变量并触发 hook 编辑的攻击者，可以提供意外的编辑器参数，从而以 进程账户的特权执行非预期操作。注意：Go 的 不会对这些参数中的 shell 操作符进行求值，因此该安全公告中的 wrapper 演示仅证明了参数传递，并未证明 shell 命令解释。此问题已在 0.27.6 版本中修复。
Possible ATT&CK Techniques 1 AI
T1059.004 · Unix ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| uniget-org | cli | < 0.27.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55061
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
uniget: EDITOR Command Injection in uniget CLI
Source: CVE Program / CVE List V5
Vulnerability Description
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| uniget-org | cli | < 0.27.6 | - |
|
II. Public POCs for CVE-2026-55061
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55061
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55061 (1)
Vendor Advisories for CVE-2026-55061 (1)
Vendor Pages for CVE-2026-55061 (1)
IV. Related Vulnerabilities
Same product: cli
-
CVE-2026-55062
uniget: Path Traversal in Hook Files - Directory Escape Vuln -
CVE-2026-72924
GitHub CLI: `gh codespace ports forward` exposes forwarded s -
CVE-2026-64655
GitHub CLI: Attestation Verification Bypass via Unescaped Re -
CVE-2026-64654
GitHub CLI: Terminal escape sequence injection in multiple ` -
CVE-2026-64653
GitHub CLI: Unescaped variable components in request URLs co
Same weakness: CWE-88
-
CVE-2026-93337
NetworkManager-l2tp Privilege Escalation via pppd Plugin Inj -
CVE-2026-89036
Appwrite < 2.0.0 Argument Injection via providerRootDirector -
CVE-2026-86864
pgAdmin 4: Argument and connection-string injection via the -
CVE-2026-86862
pgAdmin 4: Connection-string injection via the database fiel -
CVE-2026-76866
Netcore NR255-V 1.5.130703 OS Command Argument Injection via
V. Comments for CVE-2026-55061
No comments yet