The vulnerability is a shell injection flaw in Ubuntu’s language helper scripts (save-to-pam-env, update-langlist), which are part of the accountsservice package. The scripts treat the user‑controlled LANGUAGE entry in ~/.pam_environment as trusted input and interpolate it unescaped into a GNU sed replacement expression. An attacker can craft a value that injects a sed 'e' flag and arbitrary shell commands. When the SetLanguage D‑Bus method is invoked, the AccountsService helper process runs with real UID 0, executing the injected code with root privileges. This amounts to a classic command‑injection scenario that yields full system compromise. The weakness corresponds to CWE‑78: Improper Neutralization of Input During Command Execution.

Canonical accountsservice on Ubuntu is affected when the installed version is earlier than 23.13.9-8ubuntu7. The vulnerability exists in the version shipped before that release; later releases include the fix.

The CVSS score of 7.8 indicates a high severity of the flaw. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, so the known exploitation probability is uncertain. However, the vulnerability can be triggered by a legitimate SetLanguage call, meaning that a local user or user with ability to modify ~/.pam_environment can potentially exploit the flaw. The lack of a publicly known exploit suggests that the risk is primarily theoretical until a suitable exploit is discovered, but the privileged nature of the vulnerability makes it particularly dangerous for users running the affected package.