{"id":"CVE-2026-61898","aliases":["EUVD-2026-63380","GHSA-vqj6-342m-9cvg","UBUNTU-CVE-2026-61898"],"status":"published","title":"accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts","description":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00188,"percentile":0.08519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-07-21T16:00:00Z","modified":"2026-10-18T20:10:00Z","fixes":[{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"accountsservice","fixed_in":["0.6.35-0ubuntu7.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"accountsservice","fixed_in":["0.6.40-2ubuntu11.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"accountsservice","fixed_in":["0.6.45-1ubuntu1.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"accountsservice","fixed_in":["0.6.55-0ubuntu12~20.04.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"accountsservice","fixed_in":["22.07.5-2ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"accountsservice","fixed_in":["23.13.9-2ubuntu6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"accountsservice","fixed_in":["23.13.9-8ubuntu5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.35-0ubuntu7.3+esm4"}]}],"versions":["0.6.34-0ubuntu6","0.6.34-0ubuntu7","0.6.35-0ubuntu1","0.6.35-0ubuntu2","0.6.35-0ubuntu3","0.6.35-0ubuntu4","0.6.35-0ubuntu5","0.6.35-0ubuntu6","0.6.35-0ubuntu7","0.6.35-0ubuntu7.1","0.6.35-0ubuntu7.2","0.6.35-0ubuntu7.3","0.6.35-0ubuntu7.3+esm2","0.6.35-0ubuntu7.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.40-2ubuntu11.6+esm2"}]}],"versions":["0.6.40-2ubuntu5","0.6.40-2ubuntu6","0.6.40-2ubuntu7","0.6.40-2ubuntu8","0.6.40-2ubuntu9","0.6.40-2ubuntu10","0.6.40-2ubuntu11","0.6.40-2ubuntu11.1","0.6.40-2ubuntu11.2","0.6.40-2ubuntu11.3","0.6.40-2ubuntu11.6","0.6.40-2ubuntu11.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.45-1ubuntu1.3+esm2"}]}],"versions":["0.6.42-0ubuntu3","0.6.42-0ubuntu4","0.6.45-1ubuntu1","0.6.45-1ubuntu1.3","0.6.45-1ubuntu1.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.55-0ubuntu12~20.04.7+esm1"}]}],"versions":["0.6.55-0ubuntu10","0.6.55-0ubuntu11","0.6.55-0ubuntu12~20.04.1","0.6.55-0ubuntu12~20.04.2","0.6.55-0ubuntu12~20.04.4","0.6.55-0ubuntu12~20.04.5","0.6.55-0ubuntu12~20.04.6","0.6.55-0ubuntu12~20.04.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.07.5-2ubuntu1.6"}]}],"versions":["0.6.55-0ubuntu14","0.6.55-3ubuntu1","0.6.55-3ubuntu2","0.6.55-3ubuntu4","0.6.55-3ubuntu5","0.6.55-3ubuntu6","22.07.5-2ubuntu1","22.07.5-2ubuntu1.3","22.07.5-2ubuntu1.4","22.07.5-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.13.9-2ubuntu6.1"}]}],"versions":["23.13.9-2ubuntu2","23.13.9-2ubuntu4","23.13.9-2ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"accountsservice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.13.9-8ubuntu5.2"}]}],"versions":["23.13.9-7ubuntu1","23.13.9-8ubuntu1","23.13.9-8ubuntu2","23.13.9-8ubuntu4","23.13.9-8ubuntu5","23.13.9-8ubuntu5.1"]}],"products":[{"vendor":"canonical","product":"accountsservice"},{"vendor":"ubuntu","product":"accountsservice"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985","tags":["issue-tracking"]},{"url":"https://ubuntu.com/security/CVE-2026-61898","tags":["vendor-advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61898"},{"url":"https://github.com/advisories/GHSA-vqj6-342m-9cvg"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61898","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8580-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8580-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-61898","title":"accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts","description":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.","status":"published","published":"2026-08-20T14:32:59.924Z","modified":"2026-08-26T19:50:34.552Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-63380","description":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.","status":"published","published":"2026-08-20T14:32:59Z","modified":"2026-08-26T19:50:34Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-vqj6-342m-9cvg","title":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with...","description":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.","status":"published","published":"2026-08-20T15:34:20Z","modified":"2026-08-20T15:34:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:10:46.520021Z"}],"nvd":[{"id":"CVE-2026-61898","description":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.","status":"published","published":"2026-08-20T15:17:38.913Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"UBUNTU-CVE-2026-61898","description":"The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.","status":"published","published":"2026-07-21T16:00:00Z","modified":"2026-09-02T19:36:26.869314937Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"}]}}