CVE-2026-41451
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
UAC before version 3.3.0 has a command injection vulnerability in the user substitution logic in parse_artifact.sh. Usernames and home directories from /etc/passwd are substituted into command strings without proper escaping before execution via eval, allowing injection of shell metacharacters.
Risk Assessment
An attacker can execute arbitrary commands on the analyst's host, leading to full system compromise.
Recommendation
Update UAC to version 3.3.0 or later, which includes the fix.
Other vulnerabilities in UAC
See all- CVE-2026-41450High
UAC before version 3.3.0 has a command injection vulnerability in the _command_collector function, where foreach command output lines are substituted into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit malicious filenames or artifact definitions.
- CVE-2026-41449High
UAC before version 3.3.0 has a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames.
- CVE-2026-40032High
UAC (Unix-like Artifacts Collector) before version 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline. The _run_command() function passes constructed command strings directly to eval without proper sanitization, allowing attackers to inject shell metacharacters through attacker-controlled inputs such as %line% values from foreach iterators and %user%/%user_home% values derived from system files.
Original NVD description (English source)
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval. Attackers can inject shell metacharacters such as command substitution syntax or semicolons through crafted usernames or home directory paths in /etc/passwd entries to execute arbitrary commands on the analyst's host system.