CVE-2026-61898
published 2026-08-20CVE-2026-61898: The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled…
PriorityP345high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
8.0th percentile
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | accountsservice | >= 22.07.5-2ubuntu1 < 22.07.5-2ubuntu1.6 | 22.07.5-2ubuntu1.6 |
| canonical | accountsservice | >= 23.13.9-2ubuntu6 < 23.13.9-2ubuntu6.1 | 23.13.9-2ubuntu6.1 |
| canonical | accountsservice | >= 23.13.9-8ubuntu5 < 23.13.9-8ubuntu5.2 | 23.13.9-8ubuntu5.2 |
| canonical | accountsservice | >= 23.13.9-8ubuntu6 < 23.13.9-8ubuntu7 | 23.13.9-8ubuntu7 |
| ubuntu | accountsservice | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
accountsservice: accountsservice: Arbitrary code execution via shell injection
vendor_redhat·2026-08-20·CVSS 7.8
CVE-2026-61898 [HIGH] CWE-78 accountsservice: accountsservice: Arbitrary code execution via shell injection
accountsservice: accountsservice: Arbitrary code execution via shell injection
A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the ~/.pam_environment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with root privileges via the SetLanguage D-Bus method.
Statement: This Important vulnerability in `accountsservice` is specific to Ubuntu's language helper scripts. Red Hat products do not utilize these particular scripts, therefore, this flaw does not affect Red Hat Enterprise Linux or its supported derivatives.
Package: accountsservice (Red Hat Enterprise Linux 10) - Not affected
Package: accountsservice (Red Hat Enterpr
Ubuntu
AccountsService vulnerabilities
vendor_ubuntu·2026-07-21
CVE-2026-61897 AccountsService vulnerabilities
Title: AccountsService vulnerabilities
Summary: AccountsService could be made to run programs as an administrator if it
opened a specially crafted file.
It was discovered that the Ubuntu-specific SetLanguage patch to
AccountsService incorrectly handled dropping privileges. A local attacker
could use this issue to execute arbitrary commands as an administrator.
(CVE-2026-61897)
It was discovered that the Ubuntu-specific SetLanguage helpers for
AccountsService incorrectly handled parsing configuration files. A local
attacker could use this issue to execute arbitrary commands.
(CVE-2026-61898)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
AccountsService vulnerabilities
vendor_ubuntu·2026-07-21
CVE-2026-61898 AccountsService vulnerabilities
Title: AccountsService vulnerabilities
Summary: AccountsService could be made to run programs as an administrator if it
opened a specially crafted file.
USN-8580-1 fixed vulnerabilities in AccountsService. This update provides
the corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that the Ubuntu-specific SetLanguage patch to
AccountsService incorrectly handled dropping privileges. A local attacker
could use this issue to execute arbitrary commands as an administrator.
(CVE-2026-61897)
It was discovered that the Ubuntu-specific SetLanguage helpers for
AccountsService incorrectly handled parsing configuration files. A local
attacker could use this issue to execute arbitrary commands.
(CVE-2026
GHSA
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as tr
ghsa_unreviewed·2026-08-20
CVE-2026-61898 [HIGH] CWE-78 The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as tr
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
No detection rules found.
No public exploits indexed.
2026-08-20
Published