Executive brief
uniget is a command-line tool used for managing and installing other software tools. A security flaw allows an attacker to execute malicious commands on a user's computer if the user processes a specially crafted metadata file. This could lead to full system compromise, data theft, or the installation of malware with the same permissions as the user running the tool.
Technical details
A command injection vulnerability exists in uniget's metadata processing logic. The application uses `json.Unmarshal()` to populate a `Tool` struct from JSON metadata files and subsequently executes the content of the `Check` field using `/bin/bash -c` within the `RunVersionCheck` function. Because this field is not validated or sanitized, an attacker can inject shell metacharacters (e.g., `;`, `&&`, `|`) into the metadata. Exploitation occurs when a user performs common operations like `describe`, `install`, or `update` on a tool associated with the malicious metadata. This issue is patched in version 0.27.1.
Affected products
- uniget-org cli < 0.27.1
Timeline
- 2026-05-08: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched: Version 0.27.1 released