Read the docs
TI-2026-44287 Aliases CVE-2026-61898GHSA-vqj6-342m-9cvg

accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

Priority LOW 35CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00188 8th percentileScored 2026-11-07
Fix Fixed accountsservice (Canonical): 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalaccountsservice22.07.5-2ubuntu1 to before 22.07.5-2ubuntu1.6; 23.13.9-2ubuntu6 to before 23.13.9-2ubuntu6.1; 23.13.9-8ubuntu5 to before 23.13.9-8ubuntu5.2; 23.13.9-8ubuntu6 to before 23.13.9-8ubuntu722.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu7Patch availableCNA
  • accountsservice VendorCanonical Affected 22.07.5-2ubuntu1 to before 22.07.5-2ubuntu1.6; 23.13.9-2ubuntu6 to before 23.13.9-2ubuntu6.1; 23.13.9-8ubuntu5 to before 23.13.9-8ubuntu5.2; 23.13.9-8ubuntu6 to before 23.13.9-8ubuntu7 Fixed in 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu7 Patch available CNA

Remediation

  • Fix · CNA accountsservice (Canonical) Fixed in 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical accountsservice 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-44286 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scriptsPriority LOW 35
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61898
  2. 2026-10-03 Alias added: GHSA-vqj6-342m-9cvg

References

Advisory 1

Other 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences