PT-2026-1017 · Solus · Eopkg

Osmancanvural · Published 2026-01-01 · Updated 2026-03-04 · CVE-2026-21436

Positive Technologies (AI Summary)

CVSS v4.0

5.8

Medium

Base vector

AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions eopkg versions prior to 4.4.0

Description eopkg is a package manager for Solus implemented in Python3. A malicious package could bypass the directory restrictions imposed by the --destdir option. Exploitation requires installing a package from a compromised or malicious source. Such packages would then install files outside the intended --destdir location on the host system. Users who only install packages from the official Solus repositories are not affected.

Recommendations Update to version 4.4.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2026-21436

GHSA-786V-47CQ-QM6M

Affected Products

Eopkg

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21436.json · Exploit
• https://github.com/getsolus/eopkg/pull/201 · Patch
• https://github.com/getsolus/eopkg/commit/e7694323ed64e08b5b4b108fff273c64125cd39d · Patch
• https://github.com/getsolus/eopkg/security/advisories/GHSA-786v-47cq-qm6m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21436 · Security Note
• https://github.com/getsolus/eopkg/releases/tag/v4.4.0 · Note
• https://twitter.com/VulmonFeeds/status/2006801636291756533 · Twitter Post
• https://twitter.com/CVEnew/status/2006861498149158965 · Twitter Post
• https://t.me/cveNotify/147449 · Telegram Post
• https://t.me/cveNotify/154220 · Telegram Post
• https://t.me/CVEtracker/41187 · Telegram Post