VULNERABILITY INTELLIGENCE

CVE-2026-21437

CVSS score5.5 MEDIUM
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-01-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.

Weakness classification

  • security-advisories@github.com: CWE-353

Primary references