CVE-2026-61898 PUBLISHED

accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

Assigner: canonical
Reserved: 11.07.2026 Published: 20.08.2026 Updated: 20.08.2026

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Product Status

Vendor Canonical
Product accountsservice
Versions Default: unaffected
  • affected from 22.07.5-2ubuntu1 to 22.07.5-2ubuntu1.6 (excl.)
  • affected from 23.13.9-2ubuntu6 to 23.13.9-2ubuntu6.1 (excl.)
  • affected from 23.13.9-8ubuntu5 to 23.13.9-8ubuntu5.2 (excl.)
  • affected from 23.13.9-8ubuntu6 to 23.13.9-8ubuntu7 (excl.)

Credits

  • Deutsche Telekom Security GmbH Red Team finder

References

Problem Types

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE