MEDIUM GitHub
CVE-2026-55061
uniget CLI has an EDITOR Command Injection
### Summary
The uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) line 199 where [strings.Split(editor, " ")](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets spli
Affected Products
- go/gitlab.com/uniget-org/cli < 0.27.6
References
- https://github.com/advisories/GHSA-qmcq-xw74-w667
- https://github.com/uniget-org/cli/security/advisories/GHSA-qmcq-xw74-w667
- https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91
- https://github.com/uniget-org/cli/releases/tag/v0.27.6
This medium severity vulnerability was published on 2026-08-17 via GitHub. Affected: go/gitlab.com/uniget-org/cli < 0.27.6.
vulnfeed aggregates 11030 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.