CVE-2026-54575: midnightbsd mport OS Command Injection

Vulnerability summary

CVE-2026-54575 is a medium (CVSS 5.8) OS Command Injection vulnerability in midnightbsd mport. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.7% of scored vulnerabilities.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 21-09-2026
   Last modifiedVulnerability information updated.

Description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle_read_install_pkg.c, libmport/delete_primative.c, and libexec/mport.create/mport.create.c. A local attacker with write access to a participating package cache or staging path could race path checks and replacement operations to redirect package downloads, cleanup, or install-related side effects outside the intended cache. The affected lifecycle helper paths also used shell-form invocation, increasing command-line interpretation risk during privileged helper execution. This issue is fixed in version 2.7.8.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.