Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T14:32:59 accountsservice: accountsservice: Arbitrary code execution via shell injection 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-78

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the ~/.pam_environment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with root privileges via the SetLanguage D-Bus method.

This Important vulnerability in `accountsservice` is specific to Ubuntu's language helper scripts. Red Hat products do not utilize these particular scripts, therefore, this flaw does not affect Red Hat Enterprise Linux or its supported derivatives. Red Hat Enterprise Linux 10 Not affected accountsservice Red Hat Enterprise Linux 7 Not affected accountsservice Red Hat Enterprise Linux 8 Not affected accountsservice Red Hat Enterprise Linux 9 Not affected accountsservice https://www.cve.org/CVERecord?id=CVE-2026-61898 https://nvd.nist.gov/vuln/detail/CVE-2026-61898 https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985 https://ubuntu.com/security/CVE-2026-61898