CVE-2026-61898
accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
- Record
CVE-2026-61898- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-63380
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
- Record
EUVD-2026-63380- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vqj6-342m-9cvg
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with...
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
- Record
GHSA-vqj6-342m-9cvg- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
- Record
CVE-2026-61898- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-61898
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
- Record
UBUNTU-CVE-2026-61898- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
accountsserviceUbuntu:Pro:14.04:LTS |
before 0.6.35-0ubuntu7.3+esm4, plus listed versions 0.6.34-0ubuntu60.6.34-0ubuntu70.6.35-0ubuntu10.6.35-0ubuntu20.6.35-0ubuntu3 Show 9 moreShow less0.6.35-0ubuntu40.6.35-0ubuntu50.6.35-0ubuntu60.6.35-0ubuntu70.6.35-0ubuntu7.10.6.35-0ubuntu7.20.6.35-0ubuntu7.30.6.35-0ubuntu7.3+esm20.6.35-0ubuntu7.3+esm3 |
0.6.35-0ubuntu7.3+esm4 |
accountsserviceUbuntu:Pro:16.04:LTS |
before 0.6.40-2ubuntu11.6+esm2, plus listed versions 0.6.40-2ubuntu50.6.40-2ubuntu60.6.40-2ubuntu70.6.40-2ubuntu80.6.40-2ubuntu9 Show 7 moreShow less0.6.40-2ubuntu100.6.40-2ubuntu110.6.40-2ubuntu11.10.6.40-2ubuntu11.20.6.40-2ubuntu11.30.6.40-2ubuntu11.60.6.40-2ubuntu11.6+esm1 |
0.6.40-2ubuntu11.6+esm2 |
accountsserviceUbuntu:Pro:18.04:LTS |
before 0.6.45-1ubuntu1.3+esm2, plus listed versions 0.6.42-0ubuntu30.6.42-0ubuntu40.6.45-1ubuntu10.6.45-1ubuntu1.30.6.45-1ubuntu1.3+esm1 |
0.6.45-1ubuntu1.3+esm2 |
accountsserviceUbuntu:Pro:20.04:LTS |
before 0.6.55-0ubuntu12~20.04.7+esm1, plus listed versions 0.6.55-0ubuntu100.6.55-0ubuntu110.6.55-0ubuntu12~20.04.10.6.55-0ubuntu12~20.04.20.6.55-0ubuntu12~20.04.40.6.55-0ubuntu12~20.04.50.6.55-0ubuntu12~20.04.60.6.55-0ubuntu12~20.04.7 |
0.6.55-0ubuntu12~20.04.7+esm1 |
accountsserviceUbuntu:22.04:LTS |
before 22.07.5-2ubuntu1.6, plus listed versions 0.6.55-0ubuntu140.6.55-3ubuntu10.6.55-3ubuntu20.6.55-3ubuntu40.6.55-3ubuntu5 Show 5 moreShow less0.6.55-3ubuntu622.07.5-2ubuntu122.07.5-2ubuntu1.322.07.5-2ubuntu1.422.07.5-2ubuntu1.5 |
22.07.5-2ubuntu1.6 |
accountsserviceUbuntu:24.04:LTS |
before 23.13.9-2ubuntu6.1, plus listed versions 23.13.9-2ubuntu223.13.9-2ubuntu423.13.9-2ubuntu6 |
23.13.9-2ubuntu6.1 |
accountsserviceUbuntu:26.04:LTS |
before 23.13.9-8ubuntu5.2, plus listed versions 23.13.9-7ubuntu123.13.9-8ubuntu123.13.9-8ubuntu223.13.9-8ubuntu423.13.9-8ubuntu523.13.9-8ubuntu5.1 |
23.13.9-8ubuntu5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-61898 is a high vulnerability (CVSS 7.8) in Canonical Accountsservice, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in accountsservice 0.6.35-0ubuntu7.3+esm4.