---
id: CVE-2026-55061
title: uniget is a universal installer and updater for (container) tools
summary: >-
  uniget is a universal installer and updater for (container) tools. Prior to
  0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or
  EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix
  as a…
severity: low
cvss: 1
cvssVector: 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-88
vendor: uniget-org
product: cli
affected:
  - cli < 0.27.6
patched:
  - gitlab.com/uniget-org/cli 0.27.6
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55061'
references:
  - url: >-
      https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91
    label: security-advisories@github.com
  - url: 'https://github.com/uniget-org/cli/releases/tag/v0.27.6'
    label: security-advisories@github.com
  - url: 'https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qmcq-xw74-w667'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.00154
epssPercentile: 0.03811
aliases:
  - GHSA-qmcq-xw74-w667
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T14:36:46.489825Z'
cvssSource: cna
ingestedAt: '2026-08-17T17:58:10.364Z'
---

## Overview

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments, so the advisory's wrapper demonstration establishes argument delivery but does not establish shell command interpretation. This issue is fixed in version 0.27.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55061)

Affected packages:

- `gitlab.com/uniget-org/cli < 0.27.6`

Patched in:

- `gitlab.com/uniget-org/cli 0.27.6`

Source: https://github.com/advisories/GHSA-qmcq-xw74-w667