CVE-2026-55061: uniget CLI has an EDITOR Command Injection

The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Split(editor, " “) naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo” which gets split into separate arguments, allowing the wrapper script to execute arbitrary commands like id. This was successfully exploited to execute uid=1000(w4nn4d13), confirming code execution is possible. The vulnerability affects hook editing and breaks configurations with modern editors like VSCode.

Vulnerable Code:

editorWithArgs := strings.Split(editor, " ")

Location Context:

editor := os.Getenv("UNIGET_EDITOR")
if len(editor) == 0 {
editor = os.Getenv("EDITOR")
}
editorWithArgs := strings.Split(editor, " ")  // ← VULNERABLE
command := exec.Command(editorWithArgs[0], editorWithArgs[1:]...)

Issue: Naive space-splitting allows injection. EDITOR=“script && id && echo” splits into [“script”, “&&”, “id”, “&&”, “echo”] enabling command execution.