48 matches found
Arbitrary Argument Injection
Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection due to the hook editor handling in cmd/uniget/hooks.go. An attacker can execute arbitrary commands by setting EDITOR or UNIGETEDITOR to a value containing shell metacharacters and then invoking the hook...
CVE-2026-55061
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...
CVE-2026-55062
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...
CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...
CVE-2026-55061
uniget CLI (a universal installer and updater for container tools) contains an argument injection vulnerability in cmd/uniget/hooks.go (line 199). The hooks edit command parses the UNIGET_EDITOR or EDITOR environment variable using strings.Split(editor, " "), passing every space-delimited suffix ...
CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...
EUVD-2026-82371
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...
CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...
CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...
EUVD-2026-82370
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...
CVE-2026-55062
CVE-2026-55062 affects uniget , a universal installer and updater for container tools. Prior to 0.27.6 , the hooks edit command in cmd/uniget/hooks.go (lines 135–160) concatenates an unvalidated hook filename with the hooks directory without sanitizing ../ sequences. The resulting path is passed ...
CVE-2026-55062: Improper Limitation of a Pathname to a Restricted Directory
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...
CVE-2026-55061: Improper Neutralization of Argument Delimiters in a Command
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...
GO-2026-6247 uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli...
GO-2026-6246 uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set in gitlab.com/uniget-org/cli
uniget CLI: Metadata signature verification only runs when UNIGETIGNOREMETADATASIGNATURE is set in gitlab.com/uniget-org/cli...
GO-2026-6248 uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli
uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli...
PT-2026-80463
uniget CLI: Metadata signature verification only runs when UNIGET IGNORE METADATA SIGNATURE is set in gitlab.com/uniget-org/cli...
PT-2026-80464
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli...
