CVE-2026-76055
HighCVSS 7.5Summary
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted.
Risk Assessment
Arbitrary OS command execution can lead to full compromise of the system running the scan, including data theft or malware installation.
Recommendation
Update blackduck-c-cpp to version 3.0.7 or later, which includes a fix for neutralizing shell metacharacters in file paths.
Other vulnerabilities in Black Duck blackduck-c-cpp
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.