{"id":"CVE-2026-54577","summary":"mport audit can inspect the wrong package when options are present","details":"mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.","aliases":["GHSA-h3m9-vj4v-c35h"],"modified":"2026-09-19T08:14:21.754644Z","published":"2026-09-17T16:49:48.323Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54577.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-693"]},"references":[{"type":"WEB","url":"https://github.com/MidnightBSD/mport/releases/tag/2.7.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54577.json"},{"type":"ADVISORY","url":"https://github.com/MidnightBSD/mport/security/advisories/GHSA-h3m9-vj4v-c35h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54577"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/pull/149"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/midnightbsd/mport","events":[{"introduced":"0"},{"fixed":"b897240dc8181c53fbee231e77f88657c1edb9a0"},{"fixed":"899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.8","2.6.7","2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6.0","2.5.1","2.5.0","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.1","2.4.0","2.3.0","2.2.9.1","2.2.9","2.2.8","2.2.7","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.2","2.0.1","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54577.json","vanir_signatures_modified":"2026-09-19T08:14:21Z","vanir_signatures":[{"source":"https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0","target":{"file":"mport/mport.c","function":"install"},"deprecated":false,"digest":{"function_hash":"178017498694571944386822326438411095953","length":1656},"id":"CVE-2026-54577-79442789","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["33288761886541973022391192950745765947","282376954453363124379336853278728817347","279343377543815083230126767945778870229","123615650064370579342120544194236986353","1320761903502779357335893957688758926","235754011070082115620363591879628777980","76570137142459398281125795495372629227","316995341391586362691939419354026923995","30208968717120251748230134269079118635","219526549921008753873447469753561202395","157590020662107472491143066687952139201","119101225499751275833571023119199497115","52804172843826604115949387545232336353","334783188950910283248600615653374335023","11955978405439942186380848132897544818","160995833418990987982093358972789486527","267557481086351209951060003422440795016","68679967235740964317058194467751202902","50296221048821320730647601691472183005","251387085355852943129718862067831108561","264523957328214824688893431209796427115","243897946141869093254847167117102986084","337105765923822804751940129965009418816","46615585686801704682225998810523684178","218346453250174044965300532861332187423","283246671023995239873194935408670894978","119884423284907136359206452759687755631","97041307398096108978214321448010929126","217754390661791459875039479550749749672","170520596257718430475835293947653223883","55666636558559567003895312541777872372","2539610615721883776576694755890526965","72290843409431673007904795456914903027","630965469388930355038920282101290563","143431770068963449798333184962844370285","292952302218127683418631000815403933127","173325098612421198357828633390393085035","261176656854276609393539471641629132593","179812386382147804670547293766123942721","199631066260776063150384469713635600649","260010682638768202188901476005608698394","7007988238174286235290488744011718939","204826438485149644185345273575867367383","300173003379859879996198553054877501639","260209324771545526938336365716258900601","202882991943324786010392682535984660453","197464520889736307810801046813093648810","191437375740672111087524022399638622671","18780089903643061838583970983938091791","47360781507150070455606663803944712382","80728591971662864447151563433700955428","64054287940969588568502899438217760830","217754390661791459875039479550749749672","170520596257718430475835293947653223883","55666636558559567003895312541777872372","94197995472315759258040097899998187303","92328919709577770806745719371777391984","178513675476856221905629054547946634053","48061888611373582270317502654032986754","332426865251874799560443666366931271674","299430981435016760443022708375357570980","93126884560421578869630854063577691196","168760571825016476273176070840357172379","157092097649851122785981819326493306397","54386890626293255415251236581772983511","96491050197655973708205368725184246469","432073940370047256341429772981634720","92368208418120565188546919971838344390"],"threshold":0.9},"id":"CVE-2026-54577-7d370eb1","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0","target":{"file":"mport/mport.c"},"deprecated":false},{"digest":{"function_hash":"222924689335595469504483095689129052634","length":2445},"id":"CVE-2026-54577-bf319f1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0","target":{"file":"mport/mport.c","function":"sort_dependencies_topological"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"4671581288642793296863990960190718304","length":12050},"id":"CVE-2026-54577-f8e77f96","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0","target":{"file":"mport/mport.c","function":"main"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}