Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection due to the hook editor handling in cmd/uniget/hooks.go. An attacker can execute arbitrary commands by setting EDITOR or UNIGETEDITOR to a value containing shell metacharacters and then invoking the hook...

CVE-2026-55061

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...