Skip to content
Heist/ feed
Back to feed
Low

uniget: EDITOR Command Injection in uniget CLI

Type: advisorySources: OSV

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-55061
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 02:07 UTC · Revision 1

Source evidence

uniget: EDITOR Command Injection in uniget CLI

core-osv · Original source

Published 17 Sept 2026, 18:23 UTC

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

osv:CVE-2026-55061
Complete source record
{
  "id": "f19e2889264ac1ca83d801635ec18c7eb29353d8630f418c174e293f2fd749e3",
  "url": "https://osv.dev/vulnerability/CVE-2026-55061",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "uniget: EDITOR Command Injection in uniget CLI",
    "summary": "uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, \" \") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.",
    "evidence": "osv:CVE-2026-55061",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-55061",
      "aliases": [
        "CVE-2026-55061",
        "GHSA-qmcq-xw74-w667",
        "GO-2026-6248"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/uniget-org/cli",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "9527d850ee79e1fc5565dfb608e1d10a9d56bc28"
                },
                {
                  "fixed": "7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.27.6"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "9527d850ee79e1fc5565dfb608e1d10a9d56bc28"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.27.6"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.27.5",
            "v0.27.4",
            "v0.27.3",
            "v0.27.2",
            "v0.27.1",
            "v0.27.0",
            "v0.26.4",
            "v0.26.3",
            "v0.26.2",
            "v0.26.1",
            "v0.26.0",
            "v0.25.3",
            "v0.25.2",
            "v0.25.1",
            "v0.25.0",
            "v0.24.27",
            "v0.25.0-rc.3",
            "v0.24.26",
            "v0.25.0-rc.2",
            "v0.25.0-rc.1",
            "v0.24.25",
            "v0.24.24",
            "v0.24.23",
            "v0.24.22",
            "v0.24.21",
            "v0.24.20",
            "v0.24.19",
            "v0.24.18",
            "v0.24.17",
            "v0.24.16",
            "v0.24.15",
            "v0.24.14",
            "v0.24.13",
            "v0.24.12",
            "v0.24.11",
            "v0.24.10",
            "v0.24.9",
            "v0.24.8",
            "v0.24.7",
            "v0.24.6",
            "v0.24.5",
            "v0.24.5-rc.1",
            "v0.24.5-rc.0",
            "v0.24.4",
            "v0.24.3",
            "v0.24.2",
            "v0.24.1",
            "v0.24.0",
            "v0.24.0-rc.6",
            "v0.24.0-rc.5",
            "v0.24.0-rc.4",
            "v0.24.0-rc.3",
            "v0.24.0-rc.2",
            "v0.24.0-rc.1",
            "v0.23.13",
            "v0.23.12",
            "v0.23.11",
            "v0.23.10",
            "v0.23.9",
            "v0.23.8",
            "v0.23.7",
            "v0.23.6",
            "v0.23.5",
            "v0.23.4",
            "v0.23.3",
            "v0.23.2",
            "v0.23.1",
            "v0.23.0",
            "v0.22.5",
            "v0.22.4",
            "v0.22.3",
            "v0.22.2",
            "v0.22.1",
            "v0.22.0",
            "v0.21.5",
            "v0.21.4",
            "v0.21.3",
            "v0.21.2",
            "v0.21.1",
            "v0.21.0",
            "v0.20.1",
            "v0.20.0",
            "v0.19.11",
            "v0.19.10",
            "v0.19.9",
            "v0.19.8",
            "v0.19.7",
            "v0.19.6",
            "v0.19.5",
            "v0.19.4",
            "v0.19.3",
            "v0.19.2",
            "v0.19.1",
            "v0.19.0",
            "v0.18.10",
            "v0.18.9",
            "v0.18.8",
            "v0.18.7",
            "v0.18.6",
            "v0.18.5",
            "v0.18.4",
            "v0.18.3",
            "v0.18.2",
            "v0.18.1",
            "v0.18.0-rc.7",
            "v0.18.0",
            "v0.18.0-rc.6",
            "v0.18.0-rc.5",
            "v0.18.0-rc.4",
            "v0.18.0-rc.3",
            "v0.18.0-rc.2",
            "v0.17.16",
            "v0.18.0-rc.1",
            "v0.17.15",
            "v0.17.14",
            "v0.17.13",
            "v0.17.12",
            "v0.17.11",
            "v0.17.10",
            "v0.17.9",
            "v0.17.8",
            "v0.17.7",
            "v0.17.6",
            "v0.17.5",
            "v0.17.4",
            "v0.17.3",
            "v0.17.2",
            "v0.17.1",
            "v0.17.0",
            "v0.16.3",
            "v0.16.2",
            "v0.15.0",
            "v0.15.0-rc.2",
            "v0.15.0-rc.1",
            "v0.14.5-rc2",
            "v0.14.5-rc1",
            "v0.14.4",
            "v0.14.3",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.2",
            "v0.13.1",
            "v0.13.0",
            "v0.12.15",
            "v0.12.14",
            "v0.12.13",
            "v0.12.12",
            "v0.12.11",
            "v0.12.10",
            "v0.12.9",
            "v0.12.8",
            "v0.12.7",
            "v0.12.6",
            "v0.12.5",
            "v0.12.4",
            "v0.12.3",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.6",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.11.0-beta.12",
            "v0.11.0-beta.11",
            "v0.11.0-beta.10",
            "v0.11.0-beta.9",
            "v0.11.0-beta.8",
            "v0.11.0-beta.7",
            "v0.11.0-beta.6",
            "v0.11.0-beta.5",
            "v0.11.0-beta.4",
            "v0.11.0-beta.3",
            "v0.11.0-beta.2",
            "v0.10.4",
            "v0.10.3",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.0",
            "v0.8.8",
            "v0.8.7",
            "v0.8.6",
            "v0.8.5",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.0",
            "v0.6.1",
            "v0.6.0",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.1",
            "v0.2.6",
            "v0.2.5",
            "v0.3.0",
            "v0.2.4",
            "v0.2.3",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.1",
            "v0.1.0",
            "uniget-org/cli"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55061.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.629975880Z",
      "provider": "osv",
      "references": [
        "https://github.com/uniget-org/cli/releases/tag/v0.27.6",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55061.json",
        "https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-55061",
        "https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-88"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55061.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-55061",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499555,
  "published_at": "2026-09-17T18:23:15.321+00:00"
}