Frederick Jerusha

**Name of the Vulnerable Software and Affected Versions** ubuntu-pro-client versions 14.04 through 26.04 **Description** An input validation and injection issue exists in the ubuntu-pro-client (formerly ubuntu-advantage-tools). The client generates root-owned APT source files using data from the contract server response via the `directives.suites[]` and `directives.aptURL` fields. Because the client uses Python's `str.format()` without proper escaping, validation, or newline character filtering, a tampered response containing newline characters can inject arbitrary deb configuration lines. When combined with the unvalidated `additionalPackages[]` field, which is passed into a root-executed `apt-get install` command, an attacker capable of spoofing or manipulating the contract response can force the system to install malicious packages. This leads to arbitrary code execution with root privileges. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images. **Recommendations** For versions 14.04 through 26.04, run `apt update && apt upgrade` to apply the latest patches.