Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Canonical accountsservice 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1 and 2 more versions Clear all filters
TI-2026-44287 CVE-2026-61898 · GHSA-vqj6-342m-9cvg

accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

Priority LOW 35

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00188 Published 2026-08-20 Fixed in 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1 +2 CWE-78