CVE-2026-76055
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted.
Risk Assessment
Arbitrary OS command execution can lead to full compromise of the system running the scan, including data theft or malware installation.
Recommendation
Update blackduck-c-cpp to version 3.0.7 or later, which includes a fix for neutralizing shell metacharacters in file paths.
Other vulnerabilities in Black Duck blackduck-c-cpp
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS