{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-AUR-2026-005926","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-30T22:51:07Z","dateUpdated":"2026-10-30T22:51:07Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"The Arch User Repository (AUR) package `mihomo-smart-bin` was flagged as malicious by automated PKGBUILD analysis (2 indicator(s)). Building or installing this package may execute attacker-controlled code. This verdict is produced by static analysis and is subject to human review.","supportingMedia":null},{"lang":"en","value":"[B-BIN-DOMAIN-MISMATCH] -bin package upstream is wiki.metacubex.one but source downloads from github.com — matched: https://github.com/vernesong/mihomo/releases/download/LightGBM-Model/Model-large.bin","supportingMedia":null},{"lang":"en","value":"[IS-SA-HIGH-ENTROPY-HEREDOC] heredoc with high entropy (5.7 bits/byte, 258 bytes) (in install script)","supportingMedia":null}],"references":[{"url":"https://aur.archlinux.org/packages/mihomo-smart-bin","name":"","tags":["advisory"]},{"url":"https://wiki.metacubex.one/","name":"","tags":["web"]},{"url":"https://github.com/vernesong/mihomo/releases/download/Prerelease-Alpha/mihomo-linux-amd64-v3-alpha-smart-77af480.pkg.tar.zst","name":"","tags":["web"]},{"url":"https://github.com/vernesong/mihomo/releases/download/LightGBM-Model/Model-large.bin","name":"","tags":["web"]},{"url":"https://github.com/vernesong/mihomo","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/MetaCubeX/mihomo/refs/tags/v1.19.19/.github/release/mihomo.service","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/MetaCubeX/mihomo/refs/tags/v1.19.19/.github/release/config.yaml","name":"","tags":["web"]},{"url":"https://github.com/vernesong/mihomo/releases/download/Prerelease-Alpha/mihomo-linux-amd64-v3-alpha-smart-4624551.gz","name":"","tags":["web"]},{"url":"https://github.com/vernesong/mihomo/releases/download/Prerelease-Alpha/mihomo-linux-amd64-v3-alpha-smart-4624551.pkg.tar.zst","name":"","tags":["web"]}],"metrics":null,"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"aur","product":"mihomo-smart-bin","collectionURL":"https://aur.archlinux.org","packageName":"mihomo-smart-bin","repo":"","defaultStatus":"","versions":[{"version":"1.19.34.alpha.smart.r4831.g4624551-1","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null},{"version":"20261021.194528.g4624551-1","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null},{"version":"1.19.34.alpha.smart.r4842.g77af480-1","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}