https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 16:55:51 +0000 https://vulnerability.circl.lu/sighting/f5a434c5-a8dd-4b33-b32b-830a46493b13/export {"uuid": "f5a434c5-a8dd-4b33-b32b-830a46493b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FHGH-WQ4Q-R37X", "type": "seen", "source": "https://gist.github.com/alon710/714a45d6d9776f210b84a676518696fb", "content": "# GHSA-FHGH-WQ4Q-R37X: GHSA-FHGH-WQ4Q-R37X: Remote Code Execution via Sigstore Signature Verification Bypass in uniget CLI\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/GHSA-FHGH-WQ4Q-R37X\n\n## Summary\nA high-severity logic inversion flaw in the uniget CLI completely bypasses Sigstore cryptographic signature verification on metadata files by default. If an attacker can poison the package metadata cache or repository, they can execute arbitrary OS commands under the privileges of the active user.\n\n## TL;DR\nA programming mistake in the uniget CLI reversed the check for disabling metadata signature verification. As a result, the application only verifies cryptographic signatures when the user explicitly requests to ignore them, allowing unauthenticated remote code execution via poisoned metadata in default installations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Local\n- **CVSS v3.1**: 7.8\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- uniget CLI\n- **gitlab.com/uniget-org/cli**: >= 0.27.4, < 0.28.9 (Fixed in: `0.28.9`)\n\n## Mitigation\n\n- Upgrade the uniget CLI to version 0.28.9 or later to restore default signature verification.\n- For vulnerable versions, define the UNIGET_IGNORE_METADATA_SIGNATURE environment variable to force signature checking.\n- Sanitize local cache paths and verify file permissions on ~/.cache/uniget/ to prevent unauthorized metadata tampering.\n\n**Remediation Steps:**\n1. Confirm the currently installed version by running a version check command on a trusted machine.\n2. Update the executable binary using the official vendor release channels.\n3. Remove temporary environment variable workarounds once the upgrade to version 0.28.9 is complete.\n\n## References\n\n- [GHSA-FHGH-WQ4Q-R37X: Bypass of metadata signature verification](https://github.com/advisories/GHSA-fhgh-wq4q-r37x)\n- [uniget CLI Release v0.28.9](https://github.com/uniget-org/cli/releases/tag/v0.28.9)\n- [Associated Command Injection Vulnerability (CVE-2026-45152)](https://github.com/advisories/GHSA-qqq4-5773-pmw5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FHGH-WQ4Q-R37X) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-17T20:32:43.385873Z"} {"uuid": "f5a434c5-a8dd-4b33-b32b-830a46493b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FHGH-WQ4Q-R37X", "type": "seen", "source": "https://gist.github.com/alon710/714a45d6d9776f210b84a676518696fb", "content": "# GHSA-FHGH-WQ4Q-R37X: GHSA-FHGH-WQ4Q-R37X: Remote Code Execution via Sigstore Signature Verification Bypass in uniget CLI\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/GHSA-FHGH-WQ4Q-R37X\n\n## Summary\nA high-severity logic inversion flaw in the uniget CLI completely bypasses Sigstore cryptographic signature verification on metadata files by default. If an attacker can poison the package metadata cache or repository, they can execute arbitrary OS commands under the privileges of the active user.\n\n## TL;DR\nA programming mistake in the uniget CLI reversed the check for disabling metadata signature verification. As a result, the application only verifies cryptographic signatures when the user explicitly requests to ignore them, allowing unauthenticated remote code execution via poisoned metadata in default installations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Local\n- **CVSS v3.1**: 7.8\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- uniget CLI\n- **gitlab.com/uniget-org/cli**: >= 0.27.4, < 0.28.9 (Fixed in: `0.28.9`)\n\n## Mitigation\n\n- Upgrade the uniget CLI to version 0.28.9 or later to restore default signature verification.\n- For vulnerable versions, define the UNIGET_IGNORE_METADATA_SIGNATURE environment variable to force signature checking.\n- Sanitize local cache paths and verify file permissions on ~/.cache/uniget/ to prevent unauthorized metadata tampering.\n\n**Remediation Steps:**\n1. Confirm the currently installed version by running a version check command on a trusted machine.\n2. Update the executable binary using the official vendor release channels.\n3. Remove temporary environment variable workarounds once the upgrade to version 0.28.9 is complete.\n\n## References\n\n- [GHSA-FHGH-WQ4Q-R37X: Bypass of metadata signature verification](https://github.com/advisories/GHSA-fhgh-wq4q-r37x)\n- [uniget CLI Release v0.28.9](https://github.com/uniget-org/cli/releases/tag/v0.28.9)\n- [Associated Command Injection Vulnerability (CVE-2026-45152)](https://github.com/advisories/GHSA-qqq4-5773-pmw5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FHGH-WQ4Q-R37X) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-17T20:32:43.385873Z"} https://vulnerability.circl.lu/sighting/f5a434c5-a8dd-4b33-b32b-830a46493b13/export Mon, 17 Aug 2026 20:32:43 +0000