DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-FHGH-WQ4Q-R37X: GHSA-FHGH-WQ4Q-R37X: Remote Code Execution via Sigstore Signature Verification Bypass in uniget CLI

#security #cve #cybersecurity #ghsa

GHSA-FHGH-WQ4Q-R37X: Remote Code Execution via Sigstore Signature Verification Bypass in uniget CLI

Vulnerability ID: GHSA-FHGH-WQ4Q-R37X
CVSS Score: 7.8
Published: 2026-08-17

A high-severity logic inversion flaw in the uniget CLI completely bypasses Sigstore cryptographic signature verification on metadata files by default. If an attacker can poison the package metadata cache or repository, they can execute arbitrary OS commands under the privileges of the active user.

TL;DR

A programming mistake in the uniget CLI reversed the check for disabling metadata signature verification. As a result, the application only verifies cryptographic signatures when the user explicitly requests to ignore them, allowing unauthenticated remote code execution via poisoned metadata in default installations.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-347
  • Attack Vector: Local
  • CVSS v3.1: 7.8
  • Impact: Remote Code Execution (RCE)
  • Exploit Status: Proof of Concept
  • CISA KEV Status: No

Affected Systems

  • uniget CLI
  • gitlab.com/uniget-org/cli: >= 0.27.4, < 0.28.9 (Fixed in: 0.28.9)

Code Analysis

Commit: 6d8efd8

Fix logic inversion by changing signature check condition from length greater than zero to length equal to zero

Exploit Details

Mitigation Strategies

  • Upgrade the uniget CLI to version 0.28.9 or later to restore default signature verification.
  • For vulnerable versions, define the UNIGET_IGNORE_METADATA_SIGNATURE environment variable to force signature checking.
  • Sanitize local cache paths and verify file permissions on ~/.cache/uniget/ to prevent unauthorized metadata tampering.

Remediation Steps:

  1. Confirm the currently installed version by running a version check command on a trusted machine.
  2. Update the executable binary using the official vendor release channels.
  3. Remove temporary environment variable workarounds once the upgrade to version 0.28.9 is complete.

References

Read the full report for GHSA-FHGH-WQ4Q-R37X on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)