CVE-2026-21437

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-353

Affected software

Vendor	Product	Versions
getsolus	eopkg	< 4.4.0

References

https://github.com/getsolus/eopkg/commit/e7694323ed64e08b5b4b108fff273c64125cd39dPatch
https://github.com/getsolus/eopkg/pull/201Issue Tracking, Patch
https://github.com/getsolus/eopkg/releases/tag/v4.4.0Product, Release Notes
https://github.com/getsolus/eopkg/security/advisories/GHSA-hjp7-qwrj-6cc6Patch, Vendor Advisory

Timeline

Published: Jan 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-214385.3webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repea CVE-2026-214395.3badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker ma CVE-2026-21448.1The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This CVE-2026-214409.2AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker CVE-2026-214417.5urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by read CVE-2026-214436.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` CVE-2026-214445.5libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly use CVE-2026-214459.1Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints CVE-2026-214469.8Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after ini CVE-2026-214477.1Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the cust CVE-2026-214489.8Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a norm CVE-2026-214498.8Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first na