Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-45152uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution

High 7.8

In plain English

A high-severity OS command injection in cli from uniget-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check field is loaded directly from untrusted JSON metadata without validation or sanitization, an attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system when common uniget operations such as describe, install, update, or inspect are performed. This vulnerability can lead to arbitrary code execution with the privileges of the user running uniget. This vulnerability is fixed in 0.27.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	gitlab.com/uniget-org/cli	0.27.1	GHSA-qqq4-5773-pmw5
Go	gitlab.com/uniget-org/cli	0.27.1	GO-2026-5590

Affected products (as reported)

Vendor	Product	Versions
uniget-org	cli	< 0.27.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5 x_refsource_CONFIRM