Command Injection Vulnerability in Uniget Universal Installer for Container Tools

CVE-2026-45152

What is CVE-2026-45152?

Uniget, a universal installer and updater for container tools, has a command injection vulnerability in versions prior to 0.27.1. This is caused by the unsafe execution of the check field from JSON metadata, which is loaded without proper validation or sanitization. An attacker can exploit this flaw by crafting malicious metadata that, when processed during common operations like describe, install, update, or inspect, can execute arbitrary shell commands on the system running Uniget. This poses a significant risk as the arbitrary code would execute with the privileges of the user running the Uniget application. The vulnerability has been addressed in version 0.27.1.

References