CVE-2026-41450
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
UAC before version 3.3.0 has a command injection vulnerability in the _command_collector function, where foreach command output lines are substituted into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit malicious filenames or artifact definitions.
Risk Assessment
An attacker can execute arbitrary commands on the analyst's host, leading to full system compromise.
Recommendation
Update UAC to version 3.3.0 or later, which includes the fix.
Other vulnerabilities in UAC
See all- CVE-2026-41451High
UAC before version 3.3.0 has a command injection vulnerability in the user substitution logic in parse_artifact.sh. Usernames and home directories from /etc/passwd are substituted into command strings without proper escaping before execution via eval, allowing injection of shell metacharacters.
- CVE-2026-41449High
UAC before version 3.3.0 has a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames.
- CVE-2026-40032High
UAC (Unix-like Artifacts Collector) before version 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline. The _run_command() function passes constructed command strings directly to eval without proper sanitization, allowing attackers to inject shell metacharacters through attacker-controlled inputs such as %line% values from foreach iterators and %user%/%user_home% values derived from system files.
Original NVD description (English source)
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system.