CVE-2026-41449

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tclahr/uac/commit/2cc367d8ead388f05abd3cfb8af537788a124e72
https://github.com/tclahr/uac/pull/443
https://www.vulncheck.com/advisories/uac-command-injection-via-run-command-sh

Configurations

No configuration.

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de UAC (Unix-like Artifacts Collector) anteriores a la 3.3.0 contienen una vulnerabilidad de inyección de comandos en la función _run_command que permite a los atacantes ejecutar comandos arbitrarios inyectando metacaracteres de shell en datos no confiables como nombres de usuario, nombres de proceso o nombres de archivo. Los atacantes pueden explotar esta vulnerabilidad a través de entradas de evidencia manipuladas, imágenes montadas con nombres de archivo hostiles o definiciones de artefactos alteradas para lograr la ejecución remota de código en el host del analista al procesar la evidencia.

Information

Published : 2026-08-21 18:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-41449

Mitre link : CVE-2026-41449

CVE.ORG link : CVE-2026-41449

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-41449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41449", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T18:10:36.824230Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/tclahr/uac", "vendor": "tclahr", "product": "uac", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.0", "versionType": "semver"}], "packageURL": "pkg:github/tclahr/uac", "defaultStatus": "unaffected"}]}], "published": "2026-08-21T18:16:48.103", "references": [{"url": "https://github.com/tclahr/uac/commit/2cc367d8ead388f05abd3cfb8af537788a124e72", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/tclahr/uac/pull/443", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/uac-command-injection-via-run-command-sh", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence."}, {"lang": "es", "value": "Las versiones de UAC (Unix-like Artifacts Collector) anteriores a la 3.3.0 contienen una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n _run_command que permite a los atacantes ejecutar comandos arbitrarios inyectando metacaracteres de shell en datos no confiables como nombres de usuario, nombres de proceso o nombres de archivo. Los atacantes pueden explotar esta vulnerabilidad a trav\u00e9s de entradas de evidencia manipuladas, im\u00e1genes montadas con nombres de archivo hostiles o definiciones de artefactos alteradas para lograr la ejecuci\u00f3n remota de c\u00f3digo en el host del analista al procesar la evidencia."}], "lastModified": "2026-10-14T19:10:00.297", "sourceIdentifier": "disclosure@vulncheck.com"}