CVE-2026-21437CWE-353

eopkg vulnerable to package file list integrity bypass

Low · published January 1, 2026

CVSS v4.0
2.0
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:H
EPSS
0.00167 · 5.6th percentile
Weakness
CWE-353 · Missing Support for Integrity Check
Published
2026-01-01T18:06Z
EPSS history
Timeline
  • 01 JAN 18:06Z
    eopkg vulnerable to package file list integrity bypass
    cvelistv5