The uniget CLI performs signature verification on its metadata.json file to ensure integrity and authenticity. However, due to a logic inversion introduced in version 0.27.4, the signature verification only occurs if the environment variable UNIGET_IGNORE_METADATA_SIGNATURE is set, which contradicts the variable's intended purpose. Normally, when this variable is unset, the signature check is skipped, allowing untrusted metadata to be loaded. This metadata controls commands executed via /bin/bash -c, enabling an attacker who can supply or poison metadata.json to execute arbitrary commands with the privileges of the uniget user. The flaw was introduced by a code change that removed the negation in the environment variable check, flipping the condition. The vulnerability affects all uniget versions >=0.27.4 and <0.28.9. A proof of concept demonstrates remote code execution by injecting malicious commands in the metadata. The issue is tracked under CVE with a CVSS 3.1 score of 7.8 (high severity).

An attacker able to supply or tamper with the metadata.json file used by uniget can execute arbitrary commands as the user running uniget. This can occur via a compromised or attacker-controlled registry, mirror, or cache poisoning. The vulnerability enables command execution through the unchecked 'check' commands defined in the metadata, leading to full compromise of the user's environment where uniget runs. The impact includes confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:H/I:H/A:H).

A patch is available that restores the correct logic to ensure signature verification runs unless explicitly disabled. Users should upgrade to uniget version 0.28.9 or later where this issue is fixed. Until patched, avoid running uniget with untrusted metadata sources or setting the UNIGET_IGNORE_METADATA_SIGNATURE environment variable. The vendor advisory confirms a fix is available; apply the official update to remediate this vulnerability.