PT-2026-40728 · Uniget Org+1 · Cli+1

0X5T4L1N · Published 2026-05-13 · Updated 2026-05-28 · CVE-2026-45152

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions uniget versions prior to 0.27.1

Description A command injection issue exists in uniget, a universal installer and updater for container tools. The problem occurs because the check field from JSON metadata files is loaded and executed using /bin/bash -c without proper validation or sanitization. An attacker can craft malicious metadata to execute arbitrary shell commands with the privileges of the user running the software when performing operations such as describe, install, update, or inspect. This is specifically triggered within the RunVersionCheck() function, where the tool.Check variable is passed directly to the shell, allowing shell metacharacters to be interpreted.

Recommendations Update to version 0.27.1. As a temporary workaround, avoid using metadata files from untrusted sources to prevent the execution of malicious commands via the check field.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-45152

GHSA-QQQ4-5773-PMW5

Affected Products

Cli

Gitlab.Com/Uniget-Org/Cli

References · 8

• 🔥 https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5 · Exploit
• https://osv.dev/vulnerability/GHSA-qqq4-5773-pmw5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45152 · Security Note
• https://github.com/uniget-org/cli · Note
• https://github.com/uniget-org/cli/releases/tag/v0.27.1 · Note
• https://reddit.com/r/VulnMatter/comments/1tcwxup/resumen_diario_de_vulnerabilidades_14052026 · Reddit Post
• https://t.me/CVEtracker/55186 · Telegram Post
• https://t.me/cveNotify/164954 · Telegram Post