CVE-2026-59680: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in SUSE yast2-users

The vulnerability exists in the get_password_term() function within src/include/users/dialogs.rb of yast2-users. This function reads shadowLastChange and shadowExpire fields using GetString(), which does not perform numeric validation. The resulting string is passed to format_days_after_epoch(), which interpolates the value into a shell command executed via Ruby backticks without escaping or quoting. This leads to OS command injection, allowing root-level command execution when an administrator views or edits the affected user's "Password Settings" tab. No domain join or trust setup is required to trigger this.

An attacker with administrator privileges managing users through yast2-users against an external or federated LDAP directory can achieve root command execution by viewing or editing a user's "Password Settings" tab. This can lead to full system compromise. The vulnerability affects confidentiality, integrity, and availability (high impact on all three).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid viewing or editing the "Password Settings" tab for users managed via external or federated LDAP directories using yast2-users. Monitor vendor communications for an official fix.