adguard-cli-bin

MEDIUM

maintainer Jarsey45 4 votes scanned 2026-10-23 00:02:19.781852

View on AUR

Why flagged

The package installs a setuid binary (adguard_root_helper) which grants elevated privileges, a legitimate requirement for some functionality but a potential security risk if misused or exploited.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:46 chmod u+s "${pkgdir}/usr/share/adguard-cli/adguard_root_helper"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a setuid binary (adguard_root_helper) which grants elevated privileges, a legitimate requirement for some functionality but a potential security risk if misused or exploited.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jarsey45 <hidden>
    
      2# Contributor: bash000000 <hidden>
    
      3
    
      4# Certificate installed at /usr/share/adguard-cli/
    
      5
    
      6pkgname=adguard-cli-bin
    
      7pkgver=1.5.0
    
      8_pkgstatus=release
    
      9pkgrel=1
    
      10pkgdesc='Surf the Web ad-free and safely. Shields up'
    
      11arch=('x86_64')
    
      12url='https://github.com/AdguardTeam/AdGuardCLI'
    
      13options=('!strip')
    
      14install='adguard-cli.install'
    
      15conflicts=('adguard-cli-nightly-bin')
    
      16
    
      17_full_name="adguard-cli-${pkgver}-linux-${arch}"
    
      18
    
      19source=(
    
      20  "https://github.com/AdguardTeam/AdGuardCLI/releases/download/v${pkgver}/${_full_name}.tar.gz"
    
      21)
    
      22sha256sums=('e515de4a4b36d31067416731abe1450e494edd3743df766d9e4673b9ed9f3e28')
    
      23
    
      24package() {
    
      25  cd "${srcdir}/${_full_name}"
    
      26  # binaries
    
      27  install -Dp "adguard-cli" "${pkgdir}/usr/share/adguard-cli/adguard-cli"
    
      28  install -Dp "adguard_root_helper" "${pkgdir}/usr/share/adguard-cli/adguard_root_helper"
    
      29  install -Dp "certutil" "${pkgdir}/usr/share/adguard-cli/certutil"
    
      30  install -Dp "adguard_cli_nm" "${pkgdir}/usr/share/adguard-cli/adguard_cli_nm"
    
      31  # signatures
    
      32  install -D -m644 "adguard-cli.sig" "${pkgdir}/usr/share/adguard-cli/adguard-cli.sig"
    
      33  install -D -m644 "adguard_root_helper.sig" "${pkgdir}/usr/share/adguard-cli/adguard_root_helper.sig"
    
      34  install -D -m644 "certutil.sig" "${pkgdir}/usr/share/adguard-cli/certutil.sig"
    
      35  install -D -m644 "adguard_cli_nm.sig" "${pkgdir}/usr/share/adguard-cli/adguard_cli_nm.sig"
    
      36  # scripts and other files
    
      37  install -D "bash-completion.sh" "${pkgdir}/usr/share/bash-completion/completions/adguard-cli.sh"
    
      38  install -D "install_cert.sh" "${pkgdir}/usr/share/adguard-cli/install-cert.sh"
    
      39  install -D "defaults.zip" "${pkgdir}/usr/share/adguard-cli/defaults.zip"
    
      40  # symlinks
    
      41  mkdir -p "${pkgdir}/usr/bin"
    
      42  ln -s /usr/share/adguard-cli/adguard-cli "${pkgdir}/usr/bin/adguard-cli"
    
      43  ln -s /usr/share/adguard-cli/adguard_root_helper "${pkgdir}/usr/bin/adguard_root_helper"
    
      44  ln -s /usr/share/adguard-cli/adguard_cli_nm "${pkgdir}/usr/bin/adguard_cli_nm"
    
      45
    
      46  chmod u+s "${pkgdir}/usr/share/adguard-cli/adguard_root_helper"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-23 00:02
@@ -4,7 +4,7 @@
 # Certificate installed at /usr/share/adguard-cli/
 
 pkgname=adguard-cli-bin
-pkgver=1.4.13
+pkgver=1.5.0
 _pkgstatus=release
 pkgrel=1
 pkgdesc='Surf the Web ad-free and safely. Shields up'
@@ -17,9 +17,9 @@
 _full_name="adguard-cli-${pkgver}-linux-${arch}"
 
 source=(
-  "https://github.com/AdguardTeam/AdGuardCLI/releases/download/v${pkgver}-${_pkgstatus}/${_full_name}.tar.gz"
+  "https://github.com/AdguardTeam/AdGuardCLI/releases/download/v${pkgver}/${_full_name}.tar.gz"
 )
-sha256sums=('0575c9a2397fc1537d9c8213811f0d79867a7953f2481f3e9677bd3f0a2cf88c')
+sha256sums=('e515de4a4b36d31067416731abe1450e494edd3743df766d9e4673b9ed9f3e28')
 
 package() {
   cd "${srcdir}/${_full_name}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 00:02:19	Medium	2
2026-10-22 21:36:17	Medium	2
2026-06-18 16:11:54	Clean	0