CVE-2026-61898: canonical accountsservice OS Command Injection
Vulnerability summary
CVE-2026-61898 is a high (CVSS 7.8) OS Command Injection vulnerability in canonical accountsservice. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 20-08-2026PublishedVulnerability first disclosed.
- 26-08-2026Last modifiedVulnerability information updated.
Description
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
+0.06 pp
From 0.13% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- accountsservice≥ 22.07.5-2ubuntu1, < 22.07.5-2ubuntu1.6 | ≥ 23.13.9-2ubuntu6, < 23.13.9-2ubuntu6.1 | ≥ 23.13.9-8ubuntu5, < 23.13.9-8ubuntu5.2 | ≥ 23.13.9-8ubuntu6, < 23.13.9-8ubuntu7
Ubuntu1 product
- accountsservice< 0.6.35-0ubuntu7.3+esm4 | < 0.6.40-2ubuntu11.6+esm2 | < 0.6.45-1ubuntu1.3+esm2 | < 0.6.55-0ubuntu12~20.04.7+esm1 | < 22.07.5-2ubuntu1.6 | < 23.13.9-2ubuntu6.1 | < 23.13.9-8ubuntu5.2
2 vendors · 2 products