CVE-2026-54577 Details
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.
A vulnerability exists in the MidnightBSD Package Manager (Mport) versions prior to 2.7.8, where the audit command improperly handled command-line arguments. The issue arises because the audit command computed option-adjusted values for local arguments but then passed the original, unadjusted arguments to the audit_package() function. This flaw could lead to incorrect auditing results, such as misidentifying command options as package names, and potentially allowing vulnerable packages to go undetected. The vulnerability has been addressed in version 2.7.8 by correcting the argument parsing to properly reset the option index and use the adjusted arguments for auditing.
Users can upgrade to MidnightBSD Mport version 2.7.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MidnightBSD/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0 | [email protected] | Source CodeVendor |
| https://github.com/MidnightBSD/mport/pull/149 | [email protected] | Source CodeVendor |
| https://github.com/MidnightBSD/mport/releases/tag/2.7.8 | [email protected] | Release NotesVendor |
| https://github.com/MidnightBSD/mport/security/advisories/GHSA-h3m9-vj4v-c35h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MidnightBSD mport | < 2.7.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |