The vulnerability arises from improper input validation in the ubuntu-pro-client when processing contract server responses. Specifically, the client uses Python's str.format() without escaping or filtering newline characters in fields directives.suites[] and directives.aptURL, enabling injection of arbitrary APT source lines. Additionally, the unvalidated additionalPackages[] field is passed directly into a root-executed apt-get install command. An attacker capable of spoofing or manipulating the contract response (e.g., via compromised infrastructure or intercepted trusted connections) can cause the client to fetch and install malicious packages, resulting in arbitrary code execution with root privileges. This affects ubuntu-pro-client versions prior to 37.3.

Successful exploitation allows an attacker who can spoof or manipulate the contract server response to inject malicious APT source lines and force installation of attacker-controlled packages with root privileges. This leads to arbitrary code execution as root on affected systems. The vulnerability affects systems with ubuntu-pro-client preinstalled and auto-attached, including supported Ubuntu Server releases and cloud provider Ubuntu Pro images. The CVSS v3.1 score is 9.0 (Critical), reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the contract server response channel to trusted sources only and monitor for suspicious network activity related to contract responses. Avoid using affected versions of ubuntu-pro-client in untrusted environments. Follow official Canonical advisories for updates and apply patches promptly once available.