CVE-2026-21437 LOW

CVE-2026-21437: eopkg vulnerable to package file list integrity bypass

Vendor Getsolus
Product eopkg
Weakness CWE-353
Published January 1, 2026
Last update January 2, 2026
View on NVD All CVEs

CVSS base score

2.0/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:H

What the vulnerability does

01Description

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.

Key dates

02Disclosure timeline

January 1, 2026 CVE published
January 2, 2026 Record updated