CVE-2026-59680

yast2-users through 5.0.8 contains an OS command injection (CWE-78): get_password_term() reads the LDAP-provided shadowLastChange and shadowExpire attributes with no numeric validation and passes them to format_days_after_epoch(), which interpolates them unquoted into a shell command executed via Ruby backticks. The flaw is triggered when an administrator uses `yast2 users` to view or edit the "Password Settings" tab of a user managed against an external or federated LDAP directory — no domain join or trust setup is required, and no public PoC exists. An attacker who can control those directory attributes (for example via a compromised or hostile LDAP directory or a low-privileged directory account) gains arbitrary command execution as root on the managed system. Affected users are administrators of SUSE/openSUSE systems running yast2-users ≤ 5.0.8 who manage users through external LDAP directories. Exploitation is not currently known in the wild, the issue is not in CISA KEV, and EPSS estimates a 2.3% chance of exploitation within 30 days.

What to do: Upgrade yast2-users to a patched release beyond 5.0.8 as soon as SUSE publishes one, and check SUSE advisories for the fixed version applicable to your product. Until then, avoid viewing or editing the Password Settings tab in `yast2 users` for LDAP-backed users, and restrict directory write access to the shadowLastChange and shadowExpire attributes to trusted administrators, ensuring only integer day values can be stored. Audit your LDAP ACLs for accounts or sources that could write attacker-controlled values into those attributes.