go

High-severity OS command injection in uniget CLI where the check field from JSON metadata is passed directly to /bin/bash -c without validation, enabling arbitrary command execution via crafted metadata files.

Unsafe EDITOR environment variable parsing in uniget CLI v0.27.3 via strings.Split() allows unintended argument injection and command execution.

Path traversal vulnerability in uniget CLI v0.27.3 allows local users to access and modify arbitrary files via directory escape sequences in hook filenames.