CVE-2026-55061

Name of the Vulnerable Software and Affected Versions uniget CLI (affected versions not specified)

Description The uniget CLI contains a command injection flaw during hook editing. The application retrieves the editor path from the UNIGET EDITOR or EDITOR environment variables and uses the strings.Split() function to parse the string by spaces. Because this method does not respect shell syntax, an attacker can inject arbitrary commands by setting the environment variable to include shell operators. This issue was confirmed through a real-world exploit that executed the id command with user privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the EDITOR and UNIGET EDITOR environment variables to trusted values to minimize the risk of exploitation.