CVE/reported/CVE-2026-45152.md

CVE-2026-45152 — uniget Command Injection via Unsafe tool.Check Execution

CVE-2026-45152 has been officially published by GitHub Security Advisories.

Overview

A command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check field is loaded directly from untrusted JSON metadata without validation or sanitization, an attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system.

CVE ID: CVE-2026-45152

Affected Version: uniget CLI ≤ 0.27.0

Fixed In: uniget CLI 0.27.1

Severity: High

CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)

---

Description

The vulnerability exists in the RunVersionCheck() function, where uniget executes the tool.Check field using /bin/bash -c.

Because metadata files are parsed directly into the Tool structure using json.Unmarshal(), attacker-controlled input can reach the shell execution sink without validation.

The following vulnerable pattern was identified:

cmd := exec.Command("/bin/bash", "-c", tool.Check+" | tr -d '\n'")

Since /bin/bash -c interprets shell metacharacters such as ;, &&, |, $(), and backticks, arbitrary shell commands may be injected and executed.

---

Impact

An attacker processing malicious metadata may be able to:

• Execute arbitrary shell commands
• Exfiltrate sensitive files or environment variables
• Install malware or backdoors
• Modify or delete accessible files
• Establish persistence on the victim machine
• Compromise CI/CD environments using uniget automation

Commands execute with the privileges of the user running uniget.

---

Preconditions

• The victim must process attacker-controlled metadata files.
• The vulnerable uniget version must invoke the tool.Check field through /bin/bash -c.
• The attacker must be able to supply malicious metadata containing shell metacharacters.

---

Workarounds

• Avoid using /bin/bash -c with untrusted input.
• Sanitize or strictly validate metadata fields before execution.
• Execute fixed binaries and arguments directly without invoking a shell.
• Run uniget in isolated or low-privilege environments when processing untrusted metadata.

---

References

• https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5

---

Discoverer

Stalin S (@0x5t4l1n)