Skip to content
OpenAdvisories

Package · Go

gitlab.com/uniget-org/cli

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 1.0
    CVE-2026-55061

    uniget: EDITOR Command Injection in uniget CLI

    uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the sele…

    uniget-org cli gitlab.com/uniget-org/cli Go
  • High 8.4
    CVE-2026-55062

    uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

    uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that …

    uniget-org cli gitlab.com/uniget-org/cli Go
  • High 7.8
    GHSA-fhgh-wq4q-r37x

    uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

    ## Summary The sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `internal/config/update.go:81` verifies the bundle only when `UNIGET_IGNORE_METADATA_SIGNATURE` is non-empty, so in a normal run, where nobody sets…

    gitlab.com/uniget-org/cli Go
  • High 7.8
    CVE-2026-45152

    uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution

    uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check field is loaded directl…

    uniget-org cli gitlab.com/uniget-org/cli Go