PT-2026-1018 · Solus · Eopkg

Osmancanvural · Publicado 2026-01-01 · Atualizado 2026-03-04 · CVE-2026-21437

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions eopkg versions prior to 4.4.0

Description eopkg, a Solus package manager implemented in python3, contains a flaw where a malicious package could include files that are not tracked by eopkg. This requires installation of a package from a malicious or compromised source. Files within such packages would not be displayed by lseopkg and related tools. Users installing packages solely from the Solus repositories are not affected.

Recommendations Update to version 4.4.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-353

Identificadores relacionados

CVE-2026-21437

GHSA-HJP7-QWRJ-6CC6

Produtos afetados

Eopkg

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21437.json · Exploit
• https://github.com/getsolus/eopkg/security/advisories/GHSA-hjp7-qwrj-6cc6 · Aviso do Fabricante
• https://github.com/getsolus/eopkg/commit/e7694323ed64e08b5b4b108fff273c64125cd39d · Correção
• https://github.com/getsolus/eopkg/releases/tag/v4.4.0 · Nota
• https://github.com/getsolus/eopkg/pull/201 · Correção
• https://t.me/cveNotify/154221 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2006861497201213848 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2006796516426502245 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21437 · Aviso do Fabricante
• https://t.me/CVEtracker/41188 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21437 · Nota de Segurança