Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-61898

accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical accountsservice

Default version status: unaffected

  • 22.07.5-2ubuntu1 to < 22.07.5-2ubuntu1.6affected
  • 23.13.9-2ubuntu6 to < 23.13.9-2ubuntu6.1affected
  • 23.13.9-8ubuntu5 to < 23.13.9-8ubuntu5.2affected
  • 23.13.9-8ubuntu6 to < 23.13.9-8ubuntu7affected

References