uniget CLI CVE-2026-55062
MEDIUM
GHSA-m6jg-wr9m-cg2f
Severity by source
Local CLI tool requires user invocation (AV:L, PR:L); trivial path traversal with no special conditions (AC:L); arbitrary file read and write confirmed (C:H, I:H); no availability impact demonstrated.
Lifecycle Timeline
2DescriptionCVE.org
Summary
Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html).
Details File: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) Lines 135-160
hookFileName := args[0] // User input not validated
hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenationHook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.
PoC
Step 1: Set cat as editor
export EDITOR="cat"Step 2: Read /etc/passwd via path traversal
./uniget hooks edit --type=pre-install "../../../../etc/passwd"Step 3: Output shows file contents
root:x:0:0:root:/root:/bin/bash
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[...]<img width="1014" height="178" alt="image" src="https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab" />
AnalysisAI
Path traversal in uniget CLI's hook filename handling exposes arbitrary local filesystem files to any user able to invoke the uniget hooks edit or hooks remove subcommands, affecting all releases prior to v0.27.6. The root cause in hooks.go is direct string concatenation of the unsanitized args[0] value with preInstallHooksDir, allowing ../ sequences to escape the designated hooks directory entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local execution of the uniget CLI binary with attacker-controlled input to the `hooks edit` or `hooks remove` subcommand's filename argument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No official CVSS score has been published by NVD or the vendor, so risk must be constructed from first principles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade uniget CLI to version 0.27.6 or later, available at https://github.com/uniget-org/cli/releases/tag/v0.27.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today