{"id":"UBUNTU-CVE-2026-54161","details":"upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution","modified":"2026-07-11T00:15:09.141883452Z","published":"2026-07-06T00:00:00Z","upstream":["CVE-2026-54161"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-54161"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-54161"},{"type":"REPORT","url":"https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"}],"affected":[{"package":{"name":"nut","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/nut?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1-4ubuntu1","2.8.3-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libnutclient2t64","binary_version":"2.8.3-2"},{"binary_name":"libnutscan3","binary_version":"2.8.3-2"},{"binary_name":"libups-nut-perl","binary_version":"2.8.3-2"},{"binary_name":"libupsclient7","binary_version":"2.8.3-2"},{"binary_name":"nut","binary_version":"2.8.3-2"},{"binary_version":"2.8.3-2","binary_name":"nut-cgi"},{"binary_version":"2.8.3-2","binary_name":"nut-client"},{"binary_name":"nut-i2c","binary_version":"2.8.3-2"},{"binary_name":"nut-ipmi","binary_version":"2.8.3-2"},{"binary_name":"nut-modbus","binary_version":"2.8.3-2"},{"binary_name":"nut-monitor","binary_version":"2.8.3-2"},{"binary_name":"nut-powerman-pdu","binary_version":"2.8.3-2"},{"binary_version":"2.8.3-2","binary_name":"nut-server"},{"binary_name":"nut-snmp","binary_version":"2.8.3-2"},{"binary_name":"nut-xml","binary_version":"2.8.3-2"},{"binary_version":"2.8.3-2","binary_name":"python3-nut"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54161.json"}},{"package":{"name":"nut","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/nut?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.3-2","2.8.4+really-2"],"ecosystem_specific":{"binaries":[{"binary_version":"2.8.4+really-2","binary_name":"libnutclient2t64"},{"binary_version":"2.8.4+really-2","binary_name":"libnutscan4"},{"binary_name":"libups-nut-perl","binary_version":"2.8.4+really-2"},{"binary_name":"libupsclient7","binary_version":"2.8.4+really-2"},{"binary_name":"nut","binary_version":"2.8.4+really-2"},{"binary_name":"nut-cgi","binary_version":"2.8.4+really-2"},{"binary_version":"2.8.4+really-2","binary_name":"nut-client"},{"binary_name":"nut-i2c","binary_version":"2.8.4+really-2"},{"binary_version":"2.8.4+really-2","binary_name":"nut-ipmi"},{"binary_version":"2.8.4+really-2","binary_name":"nut-modbus"},{"binary_name":"nut-monitor","binary_version":"2.8.4+really-2"},{"binary_name":"nut-powerman-pdu","binary_version":"2.8.4+really-2"},{"binary_name":"nut-server","binary_version":"2.8.4+really-2"},{"binary_name":"nut-snmp","binary_version":"2.8.4+really-2"},{"binary_name":"nut-xml","binary_version":"2.8.4+really-2"},{"binary_name":"python3-nut","binary_version":"2.8.4+really-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54161.json"}}],"schema_version":"1.7.5","severity":[{"type":"Ubuntu","score":"medium"}]}