CVE-2026-22584: Code Injection Vulnerability in Uni2TS Package
Summary
CVE-2026-22584: Salesforce Uni2TS has a Code Injection vulnerability. Affects uni2ts versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Uni2TS is an open-source tool designed to facilitate the conversion of various data formats into TypeScript interfaces. It is widely used in software development for its ability to streamline data handling and improve type safety in applications. However, a critical vulnerability has been identified that allows for code injection, potentially compromising the integrity of applications using this package.
Vulnerability Detail
The vulnerability arises from improper control over the generation of executable code within non-executable files. This code injection flaw allows attackers to execute arbitrary code, which can lead to unauthorized access, data breaches, and system compromise. The issue affects versions of Uni2TS up to 1.2.0, making it crucial for users to address this vulnerability promptly to safeguard their applications.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
pip install --upgrade "uni2ts==2.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of Uni2TS until they can upgrade to the patched version. Additionally, ensure that any input data is sanitized and validated to minimize the risk of code injection.
Conclusion
The CVE-2026-22584 vulnerability in the Uni2TS package poses a significant risk due to its code injection capabilities. Users are strongly advised to upgrade to version 2.0.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software dependencies effectively.
See every vulnerability recorded for uni2ts →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Versions of Uni2TS up to and including 1.2.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized code execution, data breaches, and compromise of the affected system.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
