A malicious package can include files that are not recorded by the eopkg package manager. This bypasses the integrity mechanism that tracks installed files, allowing files to exist on the system without being listed by tools such as lseopkg. The vulnerability is a CWE-353 scenario where an attacker can deliver hidden files that evade standard package management tracking, potentially compromising system integrity and making removal or auditing difficult.

Versions of eopkg older than 4.4.0, bundled with Solus, are affected. The package manager is implemented in Python3, and only installations from the official Solus repositories are safe. Users who install packages from other sources may be impacted.

The CVSS score is 2, indicating low severity. The EPSS score is below 1%, showing a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by installing a malicious or compromised package from an untrusted source, which requires local installation privileges or the ability to place a crafted package in a repository. Because the flaw only manifests during package installation and the fix appears in v4.4.0, the current risk to users relying solely on official repositories is minimal, but the risk rises if third‑party packages are used.