Skip to content
Heist/ feed
Back to feed
High

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

Type: advisorySources: OSV

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-18157
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 11:19 UTC · Revision 1

Source evidence

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

core-osv · Original source

Published 31 Jul 2026, 02:38 UTC

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.

osv:CVE-2026-18157
Complete source record
{
  "id": "a0e326bb1dae1973d04345c61c6e64f59fc60da45925448a18876f9b245baa07",
  "url": "https://osv.dev/vulnerability/CVE-2026-18157",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection",
    "summary": "A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.",
    "evidence": "osv:CVE-2026-18157",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-18157",
      "aliases": [
        "CVE-2026-18157"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/redhatinsights/yggdrasil-worker-package-manager",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5860106629ae727c7f319b7ddaa3653540d3a0e8"
                },
                {
                  "introduced": "6acf7ba2371cacc248fe8ebe26ce4a4ccc0b95a4"
                },
                {
                  "fixed": "74f90a5e080b4b8fccab7dcdee46b112128d75a0"
                },
                {
                  "fixed": "959745bb5917c17f0316af199aace6c71baa5ad7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.1.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0.2.0"
                      },
                      {
                        "fixed": "0.2.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "959745bb5917c17f0316af199aace6c71baa5ad7"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5860106629ae727c7f319b7ddaa3653540d3a0e8"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "0.1.4"
                  },
                  {
                    "range": [
                      {
                        "fixed": "74f90a5e080b4b8fccab7dcdee46b112128d75a0"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "0.2.4"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.1.3.2",
            "0.1.3.1",
            "0.1.3",
            "v0.2.3",
            "0.1.2",
            "0.1.1",
            "0.2.2",
            "0.2.1",
            "0.1.0",
            "0.2.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18157.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:34.430304293Z",
      "provider": "osv",
      "references": [
        "https://access.redhat.com/downloads/content/package-browser/",
        "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4",
        "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4",
        "https://access.redhat.com/security/cve/CVE-2026-18157",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18157.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-18157",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2465250",
        "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7",
        "https://github.com/RedHatInsights/yggdrasil-worker-package-manager"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-88"
        ],
        "cna_assigner": "redhat",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18157.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-18157",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 501981,
  "published_at": "2026-07-31T02:38:28.243+00:00"
}