Canonical accountsservice up to 23.13.9-8ubuntu6 Language Helper Scripts SetLanguage os command injection

Summaryinfo

A vulnerability has been found in Canonical accountsservice up to 23.13.9-8ubuntu6 and classified as very critical. This affects the function SetLanguage of the component Language Helper Scripts. Performing a manipulation of the argument Language results in os command injection. This vulnerability was named CVE-2026-61898. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Canonical accountsservice up to 23.13.9-8ubuntu6. This affects the function SetLanguage of the component Language Helper Scripts. The manipulation of the argument LANGUAGE with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

The advisory is shared at bugs.launchpad.net. This vulnerability is uniquely identified as CVE-2026-61898 since 07/11/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/20/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5.2 or 23.13.9-8ubuntu7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Canonical

Name

• accountsservice

Version

• 23.13.9-8ubuntu6

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion