CVE-2026-40032
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
UAC (Unix-like Artifacts Collector) before version 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline. The _run_command() function passes constructed command strings directly to eval without proper sanitization, allowing attackers to inject shell metacharacters through attacker-controlled inputs such as %line% values from foreach iterators and %user%/%user_home% values derived from system files.
Risk Assessment
An attacker can remotely execute arbitrary commands with the privileges of the UAC process, leading to full system compromise, data theft, or lateral movement within the network.
Recommendation
Immediately upgrade UAC to version 3.3.0-rc1 or later, which includes a fix that eliminates the command injection vulnerability.
Other vulnerabilities in UAC
See all- CVE-2026-41451High
UAC before version 3.3.0 has a command injection vulnerability in the user substitution logic in parse_artifact.sh. Usernames and home directories from /etc/passwd are substituted into command strings without proper escaping before execution via eval, allowing injection of shell metacharacters.
- CVE-2026-41450High
UAC before version 3.3.0 has a command injection vulnerability in the _command_collector function, where foreach command output lines are substituted into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit malicious filenames or artifact definitions.
- CVE-2026-41449High
UAC before version 3.3.0 has a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames.
Original NVD description (English source)
UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.