Description
Use of an incorrectly resolved name or reference in the pinget backend
in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community
catalog contributor to cause an installed application to be correlated
to an unrelated, attacker-controlled catalog package and to execute an
attacker-controlled installer via a crafted catalog package whose
normalized name is contained as a substring within the installed
application name when a user applies the proposed update.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | UniGetUI | ≤ 2026.2.1 | — |