Unigetui
Monthly
Arbitrary installer execution in Devolutions UniGetUI 2026.2.0 and earlier lets a WinGet community catalog contributor hijack a user's software update: because the pinget backend correlates installed applications to catalog packages by loose name-substring matching, an attacker can publish a crafted community package whose normalized name is a substring of a legitimate installed app's name, causing UniGetUI to offer and - when the user accepts - run the attacker's installer. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the fact that success requires a matching installed application and the victim actively applying the malicious update.
Arbitrary installer execution in Devolutions UniGetUI 2026.2.0 and earlier lets a WinGet community catalog contributor hijack a user's software update: because the pinget backend correlates installed applications to catalog packages by loose name-substring matching, an attacker can publish a crafted community package whose normalized name is a substring of a legitimate installed app's name, causing UniGetUI to offer and - when the user accepts - run the attacker's installer. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the fact that success requires a matching installed application and the victim actively applying the malicious update.