Vulnerability · Published Aug 20, 2026 · Assigned by canonical

CVE-2026-61898accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

High 7.8

In plain English

A high-severity OS command injection in accountsservice from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 91.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	accountsservice	22.07.5-2ubuntu1.6	UBUNTU-CVE-2026-61898
Ubuntu:24.04:LTS	accountsservice	23.13.9-2ubuntu6.1	UBUNTU-CVE-2026-61898
Ubuntu:26.04:LTS	accountsservice	23.13.9-8ubuntu5.2	UBUNTU-CVE-2026-61898

Affected products (as reported)

Vendor	Product	Versions
Canonical	accountsservice	22.07.5-2ubuntu1 – before 22.07.5-2ubuntu1.623.13.9-2ubuntu6 – before 23.13.9-2ubuntu6.123.13.9-8ubuntu5 – before 23.13.9-8ubuntu5.223.13.9-8ubuntu6 – before 23.13.9-8ubuntu7

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Launchpad Bug #2157985 issue-tracking
Ubuntu CVE Tracker vendor-advisory