Command Injection via Custom Update Source URLs

CMS fields

• Advisory: Command Injection via Custom Update Source URLs
• Advisory ID: BGSA-2026-004 (proposed; confirm availability)
• Reporter reference: BG-03
• CVE: Not assigned
• Severity: High (researcher-assessed; no CVSS score assigned)
• Affected version: 2.0.3 — commit bb3a210 (reproduced by the maintainer)
• Fixed version: 2.0.4 (maintainer-confirmed corrected release)
• Status: Draft — publication pending coordinated disclosure
• Meta title: BastionGuard Update Source Command Injection | BGSA-2026-004
• Meta description: Security advisory for a reported command-injection vulnerability in BastionGuard custom update source processing, addressed by argument-based execution.
• Index: No while draft; Yes after coordinated publication
• Redirect: None
• Suggested slug: custom-update-source-command-injection

Advisory body (English)

Summary

A custom update source URL could reportedly be interpolated into a shell command during the update workflow, allowing special characters in the URL to affect command execution.

Security impact

An attacker able to supply or influence a custom source URL could potentially execute commands with the privileges of the application process.

Affected and fixed versions

The project maintainer reproduced the reported vulnerability in BastionGuard 2.0.3, commit bb3a210. The correction is included in BastionGuard 2.0.4, as confirmed by the maintainer and supported by the reviewed source and regression tests. Versions other than the confirmed affected revision have not been exhaustively assessed.

Remediation

• Invoke download tools using separated argument vectors, not command strings interpreted by a shell.
• Restrict custom download sources to HTTPS and handle malformed or failed downloads safely.
• Avoid unsafe references to temporary UI state in asynchronous source-update callbacks.

Recommended action: Upgrade to the verified official BastionGuard 2.0.4 build or a later maintained release.

Verification scope

The corrected source uses argument-vector subprocess execution; follow-up regression checks also cover HTTPS enforcement and safer source snapshot handling. The maintainer reproduced the historical issue; independent full GTK update-workflow testing of the final release artifact was not performed in this audit environment.

Credits

Reported by Shaik Ikram. The project thanks the researcher for the responsible security report and requests that publication be coordinated with the researcher’s agreed disclosure schedule.

References

• BastionGuard source repository
• Security policy

Timeline

• Report received: October 2026
• Disclosure date: To be agreed / added before publication
• Fix release date: Confirm from the published 2.0.4 release record

Editorial verification (not part of public advisory): Maintainer confirms reproduction on bb3a210 and remediation in 2.0.4. Before publication, record the released package/tag and date, reserve the advisory ID, agree disclosure timing and credit with the researcher, and evaluate CVE eligibility through the appropriate CNA. Do not invent a CVE or CVSS score.