CVE-2026-18157

Name of the Vulnerable Software and Affected Versions yggdrasil-worker-package-manager (affected versions not specified)

Description An argument injection flaw exists in the APT backend. A local attacker with system access can use specially crafted package names starting with a hyphen to trick apt-get into interpreting them as command options. This can result in remote code execution (RCE) with root privileges, potentially compromising the system's integrity, confidentiality, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.