CVE-2026-61898: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Canonical accountsservice

The vulnerability exists in Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before version 23.13.9-8ubuntu7. These scripts improperly handle the user-controlled LANGUAGE environment variable from ~/.pam_environment by interpolating it unescaped into a GNU sed replacement expression. This improper neutralization of special elements (CWE-78) enables an attacker to inject a sed 'e' flag and arbitrary shell commands. These commands execute with the privileges of the AccountsService helper process, which runs as root (UID 0), via the SetLanguage D-Bus method. The vulnerability is confirmed in multiple specific package versions of accountsservice on Ubuntu.

Successful exploitation allows an attacker with limited privileges to execute arbitrary shell commands with root privileges on the affected system. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability.

The vulnerability affects accountsservice versions prior to 23.13.9-8ubuntu7. Users should upgrade to version 23.13.9-8ubuntu7 or later where this issue is fixed. Since the vendor advisory content is not explicitly provided here, patch status is inferred from the version range indicating fixed in 23.13.9-8ubuntu7. No additional mitigation steps are indicated. Users should apply the official update from Canonical to remediate this vulnerability.