PT-2026-1017 · Solus · Eopkg

Osmancanvural · Publicado 2026-01-01 · Atualizado 2026-03-04 · CVE-2026-21436

Positive Technologies (AI Summary)

CVSS v4.0

5.8

Média

Vetor base

AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions eopkg versions prior to 4.4.0

Description eopkg is a package manager for Solus implemented in Python3. A malicious package could bypass the directory restrictions imposed by the --destdir option. Exploitation requires installing a package from a compromised or malicious source. Such packages would then install files outside the intended --destdir location on the host system. Users who only install packages from the official Solus repositories are not affected.

Recommendations Update to version 4.4.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-24

Identificadores relacionados

CVE-2026-21436

GHSA-786V-47CQ-QM6M

Produtos afetados

Eopkg

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21436.json · Exploit
• https://github.com/getsolus/eopkg/pull/201 · Correção
• https://github.com/getsolus/eopkg/commit/e7694323ed64e08b5b4b108fff273c64125cd39d · Correção
• https://github.com/getsolus/eopkg/releases/tag/v4.4.0 · Nota
• https://github.com/getsolus/eopkg/security/advisories/GHSA-786v-47cq-qm6m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-21436 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2006801636291756533 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2006861498149158965 · Publicação no Twitter
• https://t.me/cveNotify/147449 · Publicação no Telegram
• https://t.me/cveNotify/154220 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21436 · Nota de Segurança
• https://t.me/CVEtracker/41187 · Publicação no Telegram